‘US healthcare company data breach made possible via stolen Citrix login’ – Computer – News

The data breach at the American healthcare company Change Healthcare could have occurred due to stolen login details for a Citrix portal. Andrew Witty, CEO of parent company UnitedHealth, said this in a lawsuit about the incident.

Change Healthcare processes insurance, invoices and claims for hundreds of thousands of hospitals, pharmacies and other healthcare organizations in the US. In February, the company fell victim to a ransomware attack, with major consequences for the American healthcare system. UnitedHealth then paid a ransom to prevent stolen patient data from being leaked.

Witty now says in a lawsuit that cybercriminals from the BlackCat ransomware group had been in Change Healthcare’s systems for more than a week before the ransomware attack was carried out on February 21. At the beginning of that month, attackers obtained an employee’s login information for the Citrix portal. That portal is used to work remotely. On February 8, it detected intelligence threatplatform that Change Healthcare uses, that those login details were stolen via malware, writes BleepingComputer.

Witty admits that the portal did not require two-step verification. The attacker could therefore enter with the login details. On February 12, the ransomware group breached the Citrix portal. The attackers then managed to move through the network and steal both company and patient data.

After the attack, thousands of laptops were replaced and login details were changed. The data center network and core services were also rebuilt in a few weeks. The attack ultimately cost UnitedHealth $872 million.