UnitedHealth Group has paid more than $2B to providers following cyberattack(aol.com)
aol.com
UnitedHealth Group has paid more than $2B to providers following cyberattack
https://www.aol.com/news/unitedhealth-group-paid-more-2-125226015.html
72 comments
To be clear: they haven't "lost" any money here. They probably genuinely owe providers $2B. They just don't know exactly how much until the billing systems are back online, at which point they'll reconcile.
Thoughts and prayers to their accounting department
[deleted]
Thoughts and prayers to the taxpayers, to whom all the costs will be passed down anyway.
How??
Yes.
These are the payments owed by plans.
UnitedHealth is also advancing money to some providers as well.
See: https://www.unitedhealthgroup.com/ns/changehealthcare.html
These are the payments owed by plans.
UnitedHealth is also advancing money to some providers as well.
See: https://www.unitedhealthgroup.com/ns/changehealthcare.html
The healthcare market in the US is crazy. UnitedHealth has revenues of $90b per quarter, up from $20B 15 years ago: https://valustox.com/UNH
They only make a 6% margin, but still. That's a ton of cash.
They only make a 6% margin, but still. That's a ton of cash.
Trust me it isn’t 6%. United is one of the largest healthcare companies by market cap. They have aggressively acquired physicians under Optum, and use an accounting trick called intercompany eliminations to shuffle profits and skirt the law on the medical loss ratio. https://www.axios.com/2021/07/16/unitedhealth-optum-provider...
The US has a population of 300 million people. This works out to just $300 per person per quarter (or $1,200 annually). Given almost 20% of the population is over 65 (old people really put up the healthcare cost numbers) and the sophistication of our healthcare system (we have the tech to keep you alive or prolong your life despite pretty hairy stuff happening to you), it is not a very surprising number. The real question is how to afford it all.
Consider that you also pay for Medicare and Medicaid, which combined costs as much per capita (not per user) as the UK NHS. US healthcare is extraordinarily expensive.
Point well taken. Anything US-wide adds up to a lot of money
Last I checked United had 50M people covered by their insurance plans and $400B in revenue. Rough math would be $8,000 per person.
But the revenue is similar to Amazon. They buy something for $100 and sell it for $102. Revenues look high, but just because they are a middleman.
But the revenue is similar to Amazon. They buy something for $100 and sell it for $102. Revenues look high, but just because they are a middleman.
The health insurance industry makes more money than the oil industry. It isn't a coincidence that most of our taxes go to healthcare and the top grossing industries are all built around it.
Oil business earns far more profit at far higher profit margins. Exxon alone earns more profit than all managed care organizations (health insurance companies) some years.
Revenue that is 95% paid to vendors and employees is not an interesting statistic, on a company level.
Revenue that is 95% paid to vendors and employees is not an interesting statistic, on a company level.
From the press release, this paragraph is making me hit the exploding head emoji many times:
"To assist care providers whose finances have been disrupted by the cyberattack, the company has advanced more than $2 billion thus far through multiple initiatives. The company recognizes the high level of fragmentation of the U.S. health system can result in uneven experiences, therefore it continues to enhance and expand funding support to make it easier for care providers to access funding help at no cost. To further assist care providers, the company also suspended prior authorizations for most outpatient services and utilization review of inpatient admissions for Medicare Advantage plans."
"To assist care providers whose finances have been disrupted by the cyberattack, the company has advanced more than $2 billion thus far through multiple initiatives. The company recognizes the high level of fragmentation of the U.S. health system can result in uneven experiences, therefore it continues to enhance and expand funding support to make it easier for care providers to access funding help at no cost. To further assist care providers, the company also suspended prior authorizations for most outpatient services and utilization review of inpatient admissions for Medicare Advantage plans."
[deleted]
A drop in the bucket compared to how much they normally transact, but it sounds like good PR.
At what point will cybersecurity firms arrange deals with cybercriminal organizations to keep the money flowing?
* protection for our clients
* drum up business for the market as a whole
* make competitors look bad -- especially if they get attacked directly
After all, breaking a window makes money for the glaziers.
* protection for our clients
* drum up business for the market as a whole
* make competitors look bad -- especially if they get attacked directly
After all, breaking a window makes money for the glaziers.
Cloudflare?
They provide DDoS protection to DDoS providers that would otherwise have taken each other down, so those providers can find clients for their services which further necessitates Cloudflare’s main product.
They provide DDoS protection to DDoS providers that would otherwise have taken each other down, so those providers can find clients for their services which further necessitates Cloudflare’s main product.
Wow they must be making millions on this lucrative market, defending DDoS providers from each other. An infinite money glitch!
> provide protection to DDoS providers that would otherwise have taken each other down
Given many DDOSs are originated by botnets, is this possible?
Given many DDOSs are originated by botnets, is this possible?
DDoS providers have websites marketing their services which Cloudflare allows (for free!) in the name of not policing speech. Before Cloudflare, they didn't exist because competitors would always take each other down. Anyone who wanted to hire them had to go trawling the darkweb/freenet/random hacker forums.
Maybe when supply outstrips demand? It looks like there is more than enough business for the foreseeable future that there is no need to restore to protection rackets.
UCEPROTECT has mastered the email blacklisting protection racket. Randomly list IP space on blacklist, force payment for removal, ???, profit.
cybercriminal organizations pull way more $ than cybersecurity firms do
this has already happened in a few notable cases with ddos protection providers, it’s basically digital rico
https://xkcd.com/250/
also I think there was a thing on krebs where a reputation defender company was also operating one of those mugshot search sites
https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-comp...
also I think there was a thing on krebs where a reputation defender company was also operating one of those mugshot search sites
https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-comp...
Wow aol is still a thing? Just a news site? Brings me back…
Noticed this a few years ago too.
Expect there was too much traffic to the domain for the current owner to abandon.
The Wayback machine on it, through the decades, is fascinating if you're curious.
Expect there was too much traffic to the domain for the current owner to abandon.
The Wayback machine on it, through the decades, is fascinating if you're curious.
AOL was the Google of its day. It was the internet for most people. Even the strongest giants can fall. It gives me hope for a future where someone asks "Wow Google is still a thing?"
> It was the internet for most people.
It wasn't, though. It was the largest, but never majority (except that I think it peaked with an absolute majority of CDs pressed by AOL CDs, which was an achievement, I guess.)
It wasn't, though. It was the largest, but never majority (except that I think it peaked with an absolute majority of CDs pressed by AOL CDs, which was an achievement, I guess.)
Funny how that money wouldn't have been there when someone suggested doing it right in the first place.
Of course the MBAs see this as a win as their names aren't on anything except the profits at the time. Parasites.
Of course the MBAs see this as a win as their names aren't on anything except the profits at the time. Parasites.
This (IT Integrity Charge) will become a line item on your medical bill. All the other providers will follow, prices go up, insurance companies make more money, and "shareholders" see high returns!
> We continue to call on Congress and the Administration to take additional actions now to support providers
ah yeah, the old socializing losses and privatizing profits.
ah yeah, the old socializing losses and privatizing profits.
[deleted]
> The Biden administration announced Wednesday that it has launched an investigation into the company due to the “unprecedented magnitude of the cyberattack.”
Let the coverup begin, well actually they probably started wiping days after the attack.
Let the coverup begin, well actually they probably started wiping days after the attack.
The 2 old datacenteers are still sitting there with Mandiant doing a full investigation since the attack started.
They have been migrating all their services for that business they bought to the cloud, and have already started turning up several services.
They have been migrating all their services for that business they bought to the cloud, and have already started turning up several services.
Would there be less coverup if they didn't investigate?
Good. Also, don't hire good devs, only hire the cheap ones in India.
Money saved can be paid to these providers. That way, the money stays in the us. A 10k IQ move that no one will understand.
/s ov course
Money saved can be paid to these providers. That way, the money stays in the us. A 10k IQ move that no one will understand.
/s ov course
It's to a degree orthogonal to devs your hire as well resourced APT will be able to penetrate any org regardless of quality of developers an org hires.
Any org? Would, for example, openai be included in your definition of "any org"?
Look, "in principle" stuff is not how the real world works. AFAIK, hacks happen mostly because of carelessness. No one cares because no one cares if they care (and the compensations etc reflect that). I know enough such cases in fintech (forget about other verticals), which are mostly stupid like wrong RBAC, open firewall, AWS keys taken by roommate etc and not public of course.
Look, "in principle" stuff is not how the real world works. AFAIK, hacks happen mostly because of carelessness. No one cares because no one cares if they care (and the compensations etc reflect that). I know enough such cases in fintech (forget about other verticals), which are mostly stupid like wrong RBAC, open firewall, AWS keys taken by roommate etc and not public of course.
Yes. Any org. A few million dollars guarantees you unrestricted access to any network-connected system.
The upper bound of security is unable to make attacks with a 10 M$ return unprofitable. Raising the lower bar just raises the barrier to entry for new participants, it does not stop existing ones.
Most attacks do use basic techniques since a 10 M$ payout on 10 K$ cost is still better than 10 M$ payout on 1 M$ cost. No point wasting the good stuff when the basic and cheap stuff works just as well. But if you get rid of all the cheap ways in they will still attack using the more expensive stuff since the payout is still wildly profitable.
The upper bound of security is unable to make attacks with a 10 M$ return unprofitable. Raising the lower bar just raises the barrier to entry for new participants, it does not stop existing ones.
Most attacks do use basic techniques since a 10 M$ payout on 10 K$ cost is still better than 10 M$ payout on 1 M$ cost. No point wasting the good stuff when the basic and cheap stuff works just as well. But if you get rid of all the cheap ways in they will still attack using the more expensive stuff since the payout is still wildly profitable.
I’d like to see evidence if this. Because it seems unrealistic, even a well protected org? Ok, say the employees are the weak chain. What about those with zero trust access policies?
My knowledge derives from personal experience, but if you want digestible evidence you can go read the books: “Click Here to Kill Everybody” by well known cryptographer Bruce Schneier or “This Is How They Tell Me The World Ends” by the lead cybersecurity reporter of the New York Times, Nicole Perlroth.
I mean OKTA was breached, Mandiant was breached it doesn't get more protected than those.
Foreign governments are almost certainly trying to insert intelligence agents as employees in OpenAI, and other high profile technology companies. We already know that Saudi intelligence infiltrated Twitter. There are likely many other such agents in other companies.
https://www.nbcnews.com/tech/security/former-twitter-employe...
There are certain security measures which can minimize insider threats. But ultimately it's just hard to guard against agents who are willing to commit felonies in order to carry out their missions. Even defense industry companies which have tight security over classified information have been repeatedly penetrated.
https://www.nbcnews.com/tech/security/former-twitter-employe...
There are certain security measures which can minimize insider threats. But ultimately it's just hard to guard against agents who are willing to commit felonies in order to carry out their missions. Even defense industry companies which have tight security over classified information have been repeatedly penetrated.
The Saudis gave a pile of cash to Musk so they likely have their own Room 641A now. No need for subterfuge.
Almost 90% of breaches start with an email so code your developers write have very little to do with primary attack vector. You have to realize that well resourced APT like say APT-29 actually run research labs where among other things they test their exploits against all top tier Endpoint security solutions. So if you are a target of well resourced group they are going to get in.
Inevitably the cause of the breach will be something like an open firewall.
70% of security vulnerabilities in code are memory safety issues. However the vast majority of in then wild attacks were not against security vulnerabilities but against people. No technology can protect you from someone giving out the secret keys to the attacker.
just false, if you look at most of the ransomware cases for example. This whole fixation of "human layer security" has done more harm to cybersecurity than many actually malicious things. Wasting your money and resources on training Karen from HR to spot 20% more phishing emails yields exactly the results you'd think it does.
I hope we can get out of that nonsense and tackle cyber issues with actual technological investments as it should and can be done.
I hope we can get out of that nonsense and tackle cyber issues with actual technological investments as it should and can be done.
The only part of what you said that disagrees with me is the words "just false". I don't know how to ensure "Karen from HR" doesn't fall for those things, but training is clearly not enough (or at least current training, I'm not hopeful for future efforts but...). Either way, since the attack wasn't against something a programing language can protect against no amount of fixing programming languages will help.
We need come up with answers that work despite humans not being perfect. This is a hard problem. (what gets hard is sometimes someone will lose/forget a key and so you need to issue a replacement but only to the correct person)
We need come up with answers that work despite humans not being perfect. This is a hard problem. (what gets hard is sometimes someone will lose/forget a key and so you need to issue a replacement but only to the correct person)
[deleted]
i wrote a different reply initially but i think we agree after all, and i misinterpreted your original post.
The technology solution here is not allowing Karen from HR to have a password at all and instead using something like Yubikey + FIDO, which can't be phished.
Which is great until someone who might or might not really be "Karen from HR" says they lost their Yubikey and needs a new one. This workflow must exist, but it is generally easy for an attacker to get authenticated by that system.
There's no evidence that this attack was due to poor UHG developer quality. It appears to have been an infrastructure security vulnerability in the Change Healthcare business unit, which UHG acquired just last year.
> It appears to have been an infrastructure security vulnerability in the Change Healthcare business unit
UHG developers would be responsible for the infrastructure right? And wouldn't Change have been brought under the UHG network?
UHG developers would be responsible for the infrastructure right? And wouldn't Change have been brought under the UHG network?
I worked in healthcare tech for 10 years.
I would bet my life savings UHG developers pleaded with management for years to get the resources they desperately need to resolve these problems, but management ignored every request because it didn't have any external impact.
Management in healthcare tech is comprised entirely by some of the most mind boggling idiots on Earth, whose only qualification might be being an adult, since their ability to read, write, and comprehend information is universally worse than a child. This is without exception, in my experience.
I would bet my life savings UHG developers pleaded with management for years to get the resources they desperately need to resolve these problems, but management ignored every request because it didn't have any external impact.
Management in healthcare tech is comprised entirely by some of the most mind boggling idiots on Earth, whose only qualification might be being an adult, since their ability to read, write, and comprehend information is universally worse than a child. This is without exception, in my experience.
Step one: ask for resources until you stop getting them
Step two: avoid all accountability for anything that ever happens as the resources offered to you are finite
Step two: avoid all accountability for anything that ever happens as the resources offered to you are finite
Putting the braindead straw man aside:
The systems built were designed for a business that evolved, and the assumptions and constraints changed in a way that sometimes requires redoing things. This can be as simple as an assumption about how sales will be acquiring new clients, and how those new clients affect overall system scalability. If there's a long pipeline of feature requests and sales supersedes product managers on roadmaps, doing the necessary work to scale the systems is going to be deprioritized to a point where anything other than downtime is acceptable from a business standpoint. Sales are made on features being built, not on an impending doom that has yet to happen. This extends to other aspects of systems, like security.
The systems built were designed for a business that evolved, and the assumptions and constraints changed in a way that sometimes requires redoing things. This can be as simple as an assumption about how sales will be acquiring new clients, and how those new clients affect overall system scalability. If there's a long pipeline of feature requests and sales supersedes product managers on roadmaps, doing the necessary work to scale the systems is going to be deprioritized to a point where anything other than downtime is acceptable from a business standpoint. Sales are made on features being built, not on an impending doom that has yet to happen. This extends to other aspects of systems, like security.
Pretty sure they aim to outsource 70% going forward so this isn’t as clever a joke as you would hope.