Technology
Change Healthcare ransomware attack exposes personal health information of over 100 million
Over the past few months, we’ve seen a wave of data breaches affecting millions of people, from health care giants to government contractors and more. This latest incident is yet another in a long line of alarming breaches. Change Healthcare experienced a major data breach in February this year, causing widespread disruption across the U.S. health care sector. At the time, the company did not specify how many people were affected by the breach but hinted that it might impact well more than one-third of the U.S. population, marking one of the largest known digital thefts of medical records to date.
The owner of Change Healthcare, UnitedHealth Group (UHG), has now confirmed for the first time that more than 100 million people had their personal information and health care data stolen in what was a ransomware attack.
GET SECURITY ALERTS, EXPERT TIPS – SIGN UP FOR KURT’S NEWSLETTER – THE CYBERGUY REPORT HERE
Timeline of the Change Healthcare cyberattack
The Change Healthcare cyberattack happened in February, with news going public on Feb. 21. To contain the breach, the company took its systems offline, which led to immediate disruptions across the U.S. health care sector that relies on Change’s services for claims processing, payments and data sharing. UHG CEO Andrew Witty told Congress in May that “maybe a third” of Americans’ health data was exposed in the attack.
A month later, Change Healthcare sent out a data breach notice confirming that the February ransomware attack exposed a “substantial quantity of data” affecting many Americans. UnitedHealth Group started notifying impacted individuals in late July, with notifications continuing through October, and the final tally of those affected was released this month.
The U.S. Department of Health and Human Services Office for Civil Rights (OCR) data breach portal updated the total number of impacted people to 100 million: “On October 22, 2024, Change Healthcare notified OCR that approximately 100 million individual notices have been sent regarding this breach,” reads an updated FAQ on the OCR website.
THE HIDDEN COSTS OF FREE APPS: YOUR PERSONAL INFORMATION
What data got stolen?
There’s roughly a 30% chance your personal data was compromised in this breach. Change Healthcare is one of the largest handlers of health, medical data and patient records, and in 2022 it merged with U.S. health care provider Optum as part of a deal with UHG, bringing the two giants together under UHG’s umbrella.
This merger gave Optum – already managing physician groups and providing tech and data to insurers and health care services – broader access to the patient records handled by Change. Overall, UHG offers benefit plans to more than 53 million customers in the U.S. and another 5 million globally, while Optum serves about 103 million U.S. customers.
The stolen data varies by individual but includes personal information such as names, addresses, dates of birth, phone numbers, email addresses and government ID numbers, including Social Security, driver’s license and passport numbers. On top of that, hackers may also have accessed health data, including diagnoses, medications, test results, imaging, care and treatment plans and health insurance information. Financial and banking details found in claims and payment data are also reportedly compromised.
FROM TIKTOK TO TROUBLE: HOW YOUR ONLINE DATA CAN BE WEAPONIZED AGAINST YOU
What caused the data breach?
The Change Healthcare data breach was caused by a ransomware attack, a type of malware attack that blocks access to the victim’s personal data unless a “ransom” is paid. UHG said ALPHV/BlackCat was behind the attack, a Russian-speaking ransomware and extortion gang that later took credit for the cyberattack.
However, the attack was made possible because Change Healthcare wasn’t smart enough to protect its customers’ data with multifactor authentication. The company admitted this during a House hearing into the cyberattack in April. This raises an important question: how could a company that has billions of dollars in revenue and stores data for over 100 million Americans fail at basic cybersecurity?
UHG paid a ransom to get a decryptor and for the hackers to delete the stolen data. The ransom was said to be around $22 million and was supposed to be split between the affiliate and the ransomware operation. However, BlackCat kept it all for themselves and pulled an exit scam.
This complicated things for UHG because the affiliate claimed they still had the company’s data. They later joined forces with a new group called RansomHub, leaking some of the stolen data and extorting a second ransom from UHG.
6 ways to protect yourself from Change Healthcare data breach
1) Remove your personal information from the internet: While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. Check out my top picks for data removal services here.
2) Be wary of mailbox communications: Bad actors may also try to scam you through snail mail. The data leak gives them access to your address. They may impersonate people or brands you know and use themes that require urgent attention, such as missed deliveries, account suspensions and security alerts.
3) Be cautious of phishing attempts: Be vigilant about emails, phone calls or messages from unknown sources asking for personal information. Avoid clicking on suspicious links or providing sensitive details unless you can verify the legitimacy of the request. The best way to protect yourself from clicking malicious links that install malware is to have strong antivirus protection installed on all your devices. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android and iOS devices.
4) Monitor your accounts: Breaches of this magnitude will make it a necessity for you to start routinely reviewing your bank accounts, credit card statements and other financial accounts for any unauthorized activity. If you notice any suspicious transactions, report them immediately to your bank or credit card company.
5) Recognizing and reporting a Social Security scam: If there is a problem with a person’s Social Security number or record, Social Security will typically mail a letter. You can learn more about recognizing Social Security-related scams, including how to report a scam quickly and easily online to Social Security’s Office of the Inspector General, by reading more at www.ssa.gov/scams.
6) Invest in identity theft protection: Data breaches happen every day and most never make the headlines, but with an identity theft protection service, you’ll be notified if and when you are affected. Identity theft companies can monitor personal information like your Social Security number, phone number and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.
One of the best parts of using some services is that they might include identity theft insurance of up to $1 million to cover losses and legal fees and a white-glove fraud resolution team where a U.S.-based case manager helps you recover any losses. See my tips and best picks on how to protect yourself from identity theft.
Kurt’s key takeaway
In just 2024, with over two months still to go, we’ve witnessed countless data breaches affecting millions of Americans. This highlights how valuable your data is and how little some companies are doing to protect it. Big firms with massive revenues are struggling to implement even the most basic cybersecurity measures, practically inviting cybercriminals to hack their systems. Change Healthcare fell into this trap by not implementing two-factor authentication, leaving everything from your financial details to health data in the hands of criminals.
Do you think these companies are doing enough to protect your data and is the government doing enough to catch those behind cyberattacks? Let us know by writing us at Cyberguy.com/Contact.
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you’d like us to cover. Follow Kurt on his social channels:
Answers to the most asked CyberGuy questions:
New from Kurt:
Copyright 2024 CyberGuy.com. All rights reserved.
Technology
Star Wars Outlaws’ first expansion brings Lando into the game
A few months after it first launched, Star Wars Outlaws is getting some major updates. First up is the game’s first batch of downloadable content, which adds a new storyline involving Lando Calrissian and what appears to be a very dangerous game of Sabacc. The new expansion is called Wild Card and will be followed by a second DLC update next spring called A Pirate’s Fortune.
Perhaps more significant, today, Outlaws is also getting a major update to address some of the game’s technical and design issues. Ubisoft describes it as the game’s “biggest patch yet.” Most notable, it seems, is that the stealth sections — a major point of frustration for many players — have been toned down.
Ubisoft says that the update includes “updates to stealth and combat that allow players greater choice, including using stealth or reaching for their blaster, even in syndicate territories in cities.” Similarly, there are “enemy AI and detection improvements, with players being notified when they’re being detected and can choose to escalate or change tactics to remain in stealth.”
Our first step in expanding player choice is removing forced stealth from almost all quest objectives. This doesn’t mean that sneaking is no longer a viable or even preferable option in some cases. Rather, if you’re caught while sneaking, the objective won’t fail and reset you to the last checkpoint. Instead, you’ll seamlessly transition into combat.
You can check out the full patch notes right here, and get an overview in the video below.
Also notable: while Outlaws has been on PC since launch, it was only available through the Epic Games Store and Ubisoft Connect. Today, it’s out on Steam as well.
Technology
How to protect your deliveries from getting stolen by porch pirates
As the holiday season approaches, the excitement of gift-giving can quickly turn into anxiety over package theft. With porch pirates on the prowl, your carefully delivered gifts can vanish right from your doorstep. In 2023 alone, a staggering 119 million packages were reported stolen, meaning one in every 180 deliveries disappeared into thin air.
Cities like Seattle, Memphis and San Diego have become hot spots for these unfortunate heists.
If you’ve ever found yourself racing home to rescue a package, asking neighbors to keep an eye out or, worst of all, falling victim to these sneaky thieves, you’re not alone. But don’t worry! We’ve got some tips that could save you from the holiday headache of package theft. Let’s dive in.
I’M GIVING AWAY A $500 GIFT CARD FOR THE HOLIDAYS
Tip 1: Get security cameras
First things first, consider installing security cameras around your home. Having a good camera system can really make a difference when it comes to deterring those sneaky thieves. Depending upon how well your police department responds to porch pirate package theft, position your video doorbell to capture the face of the pirate and your package deliveries. A Video Doorbell can push notifications to get a phone alert whenever anyone or anything approaches your door, even if they don’t ring the doorbell.
Also, you might want to consider adding a couple of nearly invisible wireless cameras on tree limbs near the street at your house. We did it in hopes of being able to record a license plate if ever needed for police. I can set them to send a notification when the camera detects a person or car.
When you’re shopping for cameras, look for high-resolution video so you can see everything clearly, even at night, with night vision capabilities. Motion detection is a must. It’ll alert you if someone gets too close to your front door. Plus, two-way audio lets you talk to anyone at your door, whether it’s a delivery person or someone who shouldn’t be there. And don’t forget about cloud storage. This way, you can easily access footage whenever you need it. Check out my top picks for the six best outdoor security cameras.
Pro tip: If your camera has the feature, set your video camera to notify you when it identifies packages within view.
GET MORE OF MY TOP PICKS TO AMP UP YOUR HOME SECURITY
Tip 2: Use tracking apps
Next up, make sure you’re using tracking apps for your deliveries. Most shipping companies offer tracking services that let you follow your package from the moment it leaves the warehouse until it arrives at your home.
WHAT IS ARTIFICIAL INTELLIGENCE (AI)?
If you sign up for USPS Informed Delivery, you’ll get digital previews of what’s coming to your mailbox, which is super handy. You can set up email or text alerts for delivery updates so you’re always in the loop about when your packages are arriving. Some retailers even send you photos once your package has been delivered, giving you extra reassurance that it made it safely.
BEST BLACK FRIDAY LAPTOP DEALS
Tip 3: Make sure someone is home
Now, let’s talk about timing. It’s important to have someone around to receive packages as soon as they arrive. This can be tricky since many deliveries happen during work hours. If you can swing it, try working from home on days when important packages are expected. If that’s not possible, coordinate with friends, family members or roommates so someone is always there to grab the delivery right away.
BEST HOME SECURITY SYSTEMS
Tip 4: Coordinate with your neighbors
Don’t underestimate the power of community. Teaming up with your neighbors can be a game-changer in preventing package theft. Sign up for neighborhood porch pirate alerts from popular local networks like Neighbors and Nextdoor apps. This is where people often post when they’ve had a package stolen and sometimes upload videos or images of the suspected porch pirates. Plus, making an agreement with trusted neighbors to watch each other’s packages can really enhance security; there’s strength in numbers.
BEST BLACK FRIDAY PRINTER DEALS
Tip 5: Have the package delivered somewhere else
If home delivery feels too risky, consider alternative delivery options that offer more security. Many people choose to have their packages sent to their workplace if allowed; this way, they’re less likely to be stolen than sitting on a porch all day. Retailers often provide secure pickup points where you can collect your packages at your convenience. Renting a P.O. Box or using services that hold packages for pickup at local shipping facilities are also great options for those valuable items.
KURT’S UNBEATABLE BEST BLACK FRIDAY DEALS
Tip 6: Request a signature confirmation
Another way to prevent package theft is to request a signature confirmation for your deliveries. This means that the delivery person will not leave the package at your door unless someone signs for it. You can request a signature confirmation from most delivery services, such as FedEx, UPS, USPS and DHL. This option may cost extra, but it can give you peace of mind that your package will not be stolen.
Tip 7: Send to remote pick-up locations
Did you know that most delivery services now offer remote pick-up locations? These can be secure lockers, post offices or retail counters. Amazon has hundreds of Amazon Lockers and pick-up counters across the country, which are free for Prime members. See how far away the nearest Amazon Locker is located from your home.
When you’re checking out, just click on Change next to your shipping address, then select Find a pickup location near you to see your options. Once your package is delivered, you’ll get a notification or email with a code to retrieve it from the locker or pick-up point. Some items can even be returned at these locations.
Tip 8: Amazon Key In-Garage Delivery
We added a strong deadbolt to the door leading into the house from the garage before signing up. Now, when we are not home, an Amazon delivery can be placed securely inside our garage using the free service called Amazon Key In-Garage Delivery. The addition of a smart garage controller is the first step. Once you’ve signed up for Amazon Key In-Garage Delivery, pick Key Delivery when checking out on Amazon to have your packages securely put in the garage. I really like that you can block access to your garage any time you want. The driver never needs your garage code, and access only works for their one-time delivery.
Tip 9: Provide a delivery box
Another great option is to invest in a delivery box that allows packages to be securely dropped off and stored discreetly. Just remember that you’ll need to inform delivery personnel about using the box and how it works.
Tip 10: Sign up for delivery notifications
You can get an alert each time a package arrives at your doorstep. Both FedEx and UPS will send a text when you’ve just received a delivery. Amazon will also send you a shipment text letting you know a package has just been delivered.
To set up Amazon delivery notifications, follow these quick steps.
- Log on to the Amazon site
- Go to Your Account section
- Scroll down to the Communication and Content section
- Tap Shipment Updates via Text
- Follow the on-screen instructions, tap Subscribe
Kurt’s key takeaways
Remember, simple actions like installing security cameras, using tracking apps and coordinating with neighbors can go a long way in protecting your packages. So, as you prepare for the holiday season, take these tips to heart and enjoy a worry-free gift-giving experience. Let’s keep those porch pirates at bay and ensure that every package arrives safely at your doorstep.
Have you ever had a package stolen? If so, how did you handle the situation, and what lessons did you learn? Let us know by writing us at Cyberguy.com/Contact.
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you’d like us to cover.
Follow Kurt on his social channels:
Answers to the most asked CyberGuy questions:
New from Kurt:
KURT’S HOLIDAY GIFT GUIDES
Unbeatable Best Black Friday deals
Best gifts for Men | Women | Kids | Teens | Pet lovers
Best deals: Laptops | Desktops
Copyright 2024 CyberGuy.com. All rights reserved.
Technology
This digital D&D watch lets you roll a fireball from your wrist
Dice hoarding is a common hobby among Dungeons and Dragons players, but I’m betting most won’t have a digital watch in their collection. Alongside displaying the time, day, and date, the Timestop D-20 includes all the dice-rolling features you need to play tabletop roleplaying games directly from your wrist at the push of a button.
The watch allows the wearer to digitally roll a 4-, 6-, 8-, 10-, 12-, 20-, or 100-sided dice, alongside “Advanced Combat” features such as rolling up to 12 dice at once, and D20s with advantage or disadvantage (a fancy way of rolling two dice and taking either the higher or lower results). It’ll also display specific icons when a D20 rolls a 1 or a 20 — known as a “critical failure” or “critical success” respectively in D&D.
“We wanted a fun animation while rolling, but also an overall subdued look so you could ‘take the game with you’ and even wear the watch at the office,” Timestop says in its blog describing the design process. “We included day and date complications with a perpetual calendar so it was still a practical timepiece.”
Pricing starts at $99 and is available in three colors: black, orange, and stainless steel. Shipping starts next year, with stock available for delivery in either January or February.
One feature you won’t find on the Timestop D-20 is an alarm, because alarms “aren’t fun,” according to its creator. Otherwise, it’s water-resistant, features a backlit LCD display, and uses a replaceable coin cell battery that can last up to three years with “typical use.” I’m not sure how many fireball spells would be considered typical, but it certainly offers a more unique way to play than traditional dice or digital dice-rolling apps.
-
Business1 week ago
Column: OpenAI just scored a huge victory in a copyright case … or did it?
-
Health1 week ago
Bird flu leaves teen in critical condition after country's first reported case
-
Business5 days ago
Column: Molly White's message for journalists going freelance — be ready for the pitfalls
-
World1 week ago
Sarah Palin, NY Times Have Explored Settlement, as Judge Sets Defamation Retrial
-
Politics4 days ago
Trump taps FCC member Brendan Carr to lead agency: 'Warrior for Free Speech'
-
Science2 days ago
Trump nominates Dr. Oz to head Medicare and Medicaid and help take on 'illness industrial complex'
-
Technology3 days ago
Inside Elon Musk’s messy breakup with OpenAI
-
Lifestyle4 days ago
Some in the U.S. farm industry are alarmed by Trump's embrace of RFK Jr. and tariffs