$22 Million Ransom Paid to Hackers in Change Healthcare Cyberattack
In a revelation that underscores the persistent threat of ransomware in the digital age, the medical firm Change Healthcare appears to have succumbed to one of the most significant cyber extortions in recent history. A transaction of 350 bitcoins, amounting to approximately $22 million, was recently traced to a Bitcoin address associated with the notorious hacker group AlphV, also known as BlackCat. This payment likely marks the resolution of a crippling ransomware attack that disrupted pharmacies across the United States, affecting the delivery of prescription drugs on a national scale for over ten days.
The discovery came to light amid internal disputes within the cybercriminal community, with an alleged affiliate of AlphV claiming to have been shortchanged in the distribution of the ransom from Change Healthcare. This affiliate’s grievances, aired on the cybercriminal forum RAMP, directed attention to the significant Bitcoin transaction as evidence of their claim, inadvertently signaling that the ransom demand had been met.
This incident marks a worrying development for the healthcare industry, which has increasingly found itself in the crosshairs of ransomware operators. Security experts warn that succumbing to ransom demands not only fuels the criminal endeavors of such groups but also sets a dangerous precedent, encouraging further attacks against vital healthcare services.
The payment to AlphV, if confirmed, would be among the largest known ransoms in the history of cybercrime, rivaled by few instances like the $40 million paid by financial firm CNA to the group known as Evil Corp. This lucrative outcome for AlphV signals a robust comeback, especially after the group’s operations were momentarily disrupted by an FBI intervention in December that seized its dark web assets and released decryption keys for its previous attacks.
Despite the setback, AlphV demonstrated its resilience and strategic cunning by orchestrating the attack on Change Healthcare, showcasing its capability to inflict widespread disruption. As of last Tuesday, AlphV had boasted about targeting 28 companies on its dark web extortion site, not including Change Healthcare, before the site mysteriously went offline. The reasons for this disappearance remain speculative, attributed possibly to law enforcement actions or an attempt by AlphV to regroup and evade backlash from within its own ranks.
The situation also highlights the precarious position of victims who, faced with the dire consequences of prolonged service disruptions, may find themselves contemplating the grim choice of meeting hackers’ demands. The dilemma echoes the difficult decision faced by Colonial Pipeline’s CEO Joseph Blount during the 2021 ransomware attack that had significant repercussions for fuel distribution across the Eastern Seaboard of the US.
As the cybersecurity community continues to grapple with the challenge of ransomware, the Change Healthcare incident serves as a stark reminder of the complex ethical and strategic considerations that companies must navigate in the face of such threats.