Payments to healthcare providers, which are typically processed by Change Healthcare, were abruptly halted as the company took systems offline to contain the attack. Smaller healthcare providers and rural pharmacies were hit especially hard, with many facing significant revenue losses that pushed some close to insolvency.
Ultimately, the breach compromised the personal data of potentially one-third of all US citizens and cost UnitedHealth Group (UHG), Change Healthcare’s parent company, more than $872 million in response and recovery efforts.
These costs included offering accelerated payments and no-interest, no-fee loans to thousands of affected providers, as well as incident response efforts and a complete rebuild of Change Healthcare’s systems. Factoring in revenue loss, the total cost of the attack is expected to exceed $1 billion.