Change Healthcare’s computer systems down for sixth day

©leowolfert-stock.adobe.com

Change Healthcare’s computer systems remain offline for a sixth consecutive day following a security breach initiated by a suspected “nation-state associated cyber security threat actor.”

In a statement posted on its incidents page at 8 a.m. ET Monday, the company said it expected the disruption to last at least through the day and is “working on multiple approaches to restore the impacted environment and will not take…any additional risk as we bring out systems back online.”

Change Healthcare’s parent UnitedHealth Group reported the security breach in a February 21 filing with the Securities and Exchange Commission in which it said it had “identified a suspected nation-state associated cyber security threat actor” had accessed some of its information technology systems. Change Healthcare took its systems offline that day.

UnitedHealth said in the filing that while it was “working diligently” to restore the systems affected by the breach it couldn’t estimate the extent or duration of the disruption. It provided no further details about the nature of the attack.

UnitedHealth, the nation’s largest private health insurance company, owns Optum Health, the biggest employer of doctors. Optum merged with Change Healthcare, a provider of payment and revenue cycle management technology, in 2022. According to its website Optum’s physicians provide care to more than 100 million patients in the U.S. 

On Thursday the American Hospital Association issued a cybersecurity advisory urging its members to disconnect from Optum. The association said it has been in communication with the FBI, the U.S. Department of Health and Human Services, and the Cybersecurity and Infrastructure Security Agency regarding the incident.

Health care-related data breaches have been on the rise in recent years. A study from Atlas VPN found that 87 million patients in the U.S. were victims of data breaches in 2023, up from 37 million affected in 2022.