Because that's what takes us to our next story. Less than a couple of weeks ago.
Change Health Care. That's a subsidiary of United Health here in the Twin Cities.
It was hacked
and the hackers claim to have stolen six terabytes.
That's a lot worth of medical information.
This has been causing all kinds of problems for hospitals,
pharmacies who couldn't get paid from insurance companies
and for patients who couldn't get their medicine.
But now wired is reporting that United Health Care
paid the hackers a $22 million ransom payment
to get their data back.
The article claims $22 million worth of Bitcoin was sent to the hacker group called A
V on March 1st
and it cites experts and a hacker who believe this payment
was a ransom paid by our own Minnesota's United Health Care.
So Gordon check this out. He likes this kind of stuff. Gordon, what'd you find out?
Well, I reached out to United Health to
see if they could confirm this ransom payment.
I got a short statement from their media team that said
we are focused on the investigation and restoring operations at change.
So
no confirmation but the company also isn't disputing
these claims either if this payout really happened.
Cyber security experts say it's one of the largest payouts in history
and million dollar payouts happen more often than you might think.
There's a good possibility that we are seeing the
second largest known ransom war payment in history.
Few people are closer to ransomware cases than Bryce Austin with T CE strategy.
My company has worked a ransomware engagement where the initial demand
was $8 million and regrettably the payout was over a million.
How often do these companies and organizations
pay the ransom?
Getting this information is challenging because most
companies don't want to talk about it.
We saw a wonderful example of a company paying
versus not paying late last year in Las Vegas
where both Caesars and MGM got hit by the same group at almost the same time MGM chose
not to pay but they've openly said that the
disruption cost them over $100 million in lost revenue.
Caesars chose to pay but they paid 15 million instead of 100 million.
Austin says according to many industry sources that $15 million
payout is the third highest ransom payment in us history.
The speculated $22 million payment involving change,
health care would be number two if confirmed.
And Austin says number one is a $40 million ransom payment
from the insurance company's CN A financial a few years ago,
these payouts
create a concern that it is
encouraging more of this behavior.
If every company refused to pay flatly, the issue of Rancor
would go away. My company's worked instances where we had 800 jobs on the line.
And as distasteful as paying Ranson is
there's a reasonable argument to be made that having 800
people be out of work is even more distasteful.
Is it possible that there could be other big payouts out there that just haven't been
made public yet? Oh, absolutely.
Um Most companies don't want to advertise that
they've fallen victim to this type of attack.
Austin says in many cases,
private companies don't have to disclose whether a ransom has been paid.
And even with public companies, that information can be difficult to track down
the issue of ransom payments could be more widespread than we know.
Could this just be the tip of the iceberg so to speak that as in
the years to come, those payouts
could continue to just get bigger.
It was common to see ransomware in the tens of thousands of dollars five years ago
in the hundreds of thousands of dollars two years ago
and now in the million and multi million area is becoming more and more common.
Another concern is where this ransom money is going.
According to several sources online. This ransomware group
ev also known as Black cat is connected to Russian
organized crime and millions of dollars can buy a lot of
high end computers pay more hackers and other types of
equipment that could create even bigger problems down the road.
Well, Gordon, that was absolutely terrifying.
You're welcome.
It wasn't my intention,
but that's the situation that some of these
companies are finding themselves in right now.
You know, the sci fi novel going on in my head is how do you even know that, like,
the hacker is not going to come back and say
that was a nice 22. I'm going to need 20 more to finish this.
Yeah, that's definitely a concern. I mean, these are hackers, criminals,
they're not exactly honest all the time so they could just take the money and run.
You just don't know that. Ok, thanks so much Gordon. Appreciate it.