Atlanta, Georgia – A recent ransomware attack targeting the medical firm Change Healthcare has caused widespread disruptions in pharmacies across the United States, impacting hospitals and leading to delays in prescription drug deliveries nationwide for over 10 days. The attack, orchestrated by a group known as AlphV, has taken a new turn as reports indicate a $22 million ransom payment received by the hackers.
On March 1, AlphV received 350 bitcoins, equivalent to $22 million, in a single transaction through a Bitcoin address. Following this transaction, an individual claiming to be an affiliate of AlphV posted on a cybercriminal forum alleging that the group had not fairly compensated them for their involvement in the Change Healthcare ransom attack. The affiliate cited the $22 million transaction as evidence of AlphV receiving the ransom payment.
Security experts, including Dmitry Smilyanets from Recorded Future, suggest that the large sum deposited into AlphV’s Bitcoin wallet is highly indicative of Change Healthcare paying the ransom. Although contacted for a statement, United Healthcare, the owner of Change Healthcare, declined to confirm whether a ransom had been paid, stating that they are currently focused on the investigation.
Both Recorded Future and TRM Labs, a blockchain analysis firm, have linked the Bitcoin address that received the $22 million payment to the AlphV hackers. TRM Labs further connects the address to payments from two previous AlphV victims in January, indicating a pattern of ransom payments being made to the group.
The unfolding situation involving the ransomware attack on Change Healthcare highlights the ongoing challenges and threats posed by cybercriminals to critical infrastructure and sensitive data. As more details emerge, it becomes critical for organizations to enhance their cybersecurity measures to protect against such attacks in the future. This story continues to develop, with updates expected as the investigation progresses.