By Optum, a subsidiary of UnitedHealth Group, has confirmed that a cyberattack on Change Healthcare, a health technology company that it acquired in 2022, has caused some of its services to be disrupted. The attack, which was attributed to a “nation-state” actor, affected the payment exchange platform that Optum uses to process claims and prescriptions for its clients.
According to a filing with the Securities and Exchange Commission (SEC), UnitedHealth Group disclosed that the cyberattack occurred on February 19, 2024, and that it was notified by Change Healthcare on the same day. The filing stated that the attack was “highly sophisticated” and “likely perpetrated by a nation-state actor.”
The filing also stated that the attack impacted some of the services that Optum provides to its clients, such as pharmacy benefit management, revenue cycle management, and clinical decision support. The filing did not specify which clients or how many were affected, but said that the company was working to restore the services as soon as possible.
The Attack Impacted Pharmacies and Healthcare Providers
Some of the clients that reported problems due to the attack were pharmacies and healthcare providers, who rely on Optum’s platform to bill or send claims for prescriptions or healthcare services. Some of the affected pharmacies were in Michigan, California, and Texas, according to local media reports.
One of the pharmacies, Huron Pharmacy in Bad Axe, Michigan, told the Huron Daily Tribune that it was unable to process any prescriptions electronically since February 19. The pharmacy had to resort to manual methods, such as calling insurance companies or using paper forms, which caused delays and inconvenience for customers.
Another client that was impacted was Tricare, the healthcare provider for active-duty military personnel and their families. Tricare announced on its website that the attack forced all military pharmacies worldwide to fill prescriptions manually, which could result in longer wait times or limited availability of some medications.
Optum and Change Healthcare Are Working to Resolve the Issue
Optum and Change Healthcare issued a joint statement on February 22, saying that they were working together to resolve the issue and restore the services as quickly as possible. They also said that they were cooperating with law enforcement and cybersecurity experts to investigate the attack and prevent any further damage.
The statement also said that there was no evidence that any customer or patient data was compromised or misused as a result of the attack. The statement assured that the companies were committed to protecting the privacy and security of their customers and patients.
Optum is one of the largest healthcare services and technology companies in the US, serving more than 125 million individuals and 300,000 healthcare providers. Change Healthcare is one of the largest healthcare technology companies in the US, providing software and analytics solutions to more than 2,000 payers and 1 million providers.