Change Healthcare’s cyberattack casts a light into how cybercriminal groups work

The healthcare industry is still struggling to overcome a cyberattack that took the IT company, Change Healthcare, offline in February. The cybercriminal group behind it is part of a professionalize

ROB SCHMITZ, HOST:

The health care industry is still struggling to overcome a February cyberattack that hit the IT company, Change Healthcare. The group behind the attack is part of a professionalized ecosystem that profits off companies’ digital security failings. NPR’s Jenna McLaughlin reports.

JENNA MCLAUGHLIN, BYLINE: On Wednesday, February 21, a relatively unknown IT company called Change Healthcare announced it was the victim of a cyberattack. The group of hackers behind it, who go by the name BlackCat, demanded a ransom of $22 million to return the company’s data. The hack was devastating. While Change Healthcare isn’t a household name, it plays a central role in verifying and processing payments between insurance companies and providers.

Right now, according to a source with knowledge of the situation, the company is still struggling to bring basic functionalities back online. Publicly, Change Healthcare has said it hopes to start restoring those services next week. The response is ongoing, but the breach provides a window into how these criminal ransomware gangs operate. Ram Elboim, the CEO of cybersecurity company Sygnia, has tracked BlackCat for years. Here’s how he describes them.

RAM ELBOIM: What makes them, I would say, unique is the viciousness, if we can call it, of the attacks.

MCLAUGHLIN: Elboim says BlackCat sells its malicious code to affiliates, taking a cut of the profits. They even provide human resources, a platform to negotiate payments with victims and a public leak site. The criminal ecosystem of ransomware continues to thrive. That’s partially because these groups often live outside the reach of U.S. law enforcement. A senior administration official tells NPR that many of these hackers operate…