cyber daily logo

Breaking news and updates daily. Subscribe to our Newsletter

Breaking news and updates daily. Subscribe to our Newsletter X facebook linkedin Instagram Instagram

Change Healthcare has at least US$14bn in unprocessed medical claims

Change Healthcare is playing catch-up following a cyber attack late last month, and only now preparing to process the $14 billion in built-up medical claims.

user icon Daniel Croft
Mon, 25 Mar 2024
Change Healthcare has at least US$14B in unprocessed medical claims
expand image

The organisations parent company, UnitedHealth Group, said it expects that Change Healthcare’s medical claim processing services will be coming online over the next few weeks and that during that time, it is expecting to start processing US$14 billion in medical claims from over that period.

The company has released an estimated timeline for the restoration of its services, which will be updated as products get restored. According to Change Healthcare, “products will go through a phased reconnection process, including launch, testing and scaled reconnection”.

“If a product is not listed in this schedule, that does not mean that product is more than three weeks away. It means that we do not yet have line of sight to the week that we expect it to be restored and will provide updated information as those timelines become clear.”


So far, the company says it has restored its Assurance claims preparation service back online as of 18 March, with the $14 billion in claims set up for processing as of 22 March.

The Change Healthcare attack occurred on 21 February at the hands of an ALPHV ransomware affiliate. With the company’s services unavailable for thousands of healthcare organisations and companies across the US, the attack has cost the industry millions in damages.

Despite Change Healthcare reportedly paying a US$22 million ransom payment, its systems remained encrypted and data stolen after ALPHV allegedly used the payout as an exit strategy, pocketing the money and going dark, leaving the affiliate without payment and thus, no reason to decrypt or restore Change Healthcare’s systems.

In its exit strategy, ALPHV claimed it had been taken down by law enforcement agencies once again, as it had late last year, but law enforcement quickly said they were not involved.

Also worth noting is that some experts believe that the ALPHV affiliate was a Chinese state-sponsored threat actor leveraging ALPHV’s network, however evidence is so far minimal and these claims cannot be verified.

Daniel Croft

Daniel Croft

Born in the heart of Western Sydney, Daniel Croft is a passionate journalist with an understanding for and experience writing in the technology space. Having studied at Macquarie University, he joined Momentum Media in 2022, writing across a number of publications including Australian Aviation, Cyber Security Connect and Defence Connect. Outside of writing, Daniel has a keen interest in music, and spends his time playing in bands around Sydney.

cd intro podcast

Introducing Cyber Daily, the new name for Cyber Security Connect

Click here to learn all about it
cyber daily subscribe
Be the first to hear the latest developments in the cyber industry.