![](\"https:\/\/www.insurancejournal.com\/app\/uploads\/2022\/06\/ransomware-1-580x290.jpg\")
<\/p>\n![](\"https:\/\/www.insurancejournal.com\/app\/uploads\/2022\/06\/ransomware-1-scaled.jpg\")
<\/div>\nHackers working for the \u2018Blackcat\u2019 ransomware gang are behind the outage at UnitedHealth\u2019s technology unit that has snarled prescription deliveries for six days, two people familiar with the matter told Reuters on Monday.<\/p>\n
The problems began last week after hackers gained access to Change Healthcare\u2019s information technology systems and has led to disruptions at pharmacies across the United States.<\/p>\n
Change Healthcare and UnitedHealth did not immediately respond to requests for comment. Blackcat, also known as \u201cALPHV,\u201d did not immediately respond when asked whether it was responsible.<\/p>\n
Alphabet\u2019s cybersecurity unit Mandiant is handling the investigation into the breach, the two people said. In a statement, Mandiant confirmed it \u201chas been engaged in support of the incident response\u201d but declined to comment further.<\/p>\n
Blackcat is one of the most notorious of the internet\u2019s many ransomware gangs \u2014 groups of cybercriminals who encrypt data to hold it hostage with the aim of securing massive payouts. It has previous struck major businesses including MGM Resorts International and Caesars Entertainment.<\/p>\n
In December, Blackcat was the subject of a takedown by U.S.-led international law enforcement, which seized several websites used by the group as well as hundreds of digital keys used to decrypt victims\u2019 data.<\/p>\n
The hackers had threatened to retaliate by extorting critical infrastructure providers and hospitals.<\/p>\n
CISA, the U.S. cyber watchdog agency, and the FBI also did not immediately respond to emails seeking comment.<\/p>\n
One expert said the news suggested that digital disruptions, while important, could not be counted on to knock ransomware groups out for good.<\/p>\n
\u201cIt\u2019s inevitable that if you have a group that\u2019s making millions of bucks, they are going to attempt to make a comeback,\u201d said Brett Callow, a threat analyst at the cybersecurity firm Emsisoft.<\/p>\n
The allegation that Blackcat was behind the hack at Change Healthcare also raised questions about parent company UnitedHealth\u2019s previous claim that it had been targeted by a \u201csuspected nation-state associated cybersecurity threat actor.\u201d<\/p>\n
\u201cI am not aware of any links between ALPHV and a nation state,\u201d Callow said. \u201cAs far as I am aware they are financially motivated cybercriminals and nothing more.\u201d<\/p>\n
Reuters has not been able to gauge the full extent of the disruption.<\/p>\n
A number of pharmacy chains, including CVS Health and Walgreens, have said the outage had knock-on effects on their businesses.<\/p>\n
The American Pharmacists Association (APhA) said on Friday many pharmacies across the nation could not transmit insurance claims for their patients following the hack.<\/p>\n
It said pharmacies were reporting \u201csignificant backlogs of prescriptions,\u201d which they were unable to process.<\/p>\n
Topics<\/span> Cyber<\/a> USA<\/a> <\/p>\n<\/p><\/div>\n Was this article valuable?<\/p>\n<\/p><\/div>\n