US offers $10 million to help catch Change Healthcare hackers

The U.S. government says it is extending a reward for information on key leadership of the ALPHV/BlackCat cybercriminal gang to its affiliated members, one of whom was credited with launching a massive ransomware attack on a U.S. health tech giant last month.

The U.S. State Department said in a statement on Wednesday that it is offering a reward of up to $10 million for information that identifies or locates anyone associated with ALPHV/BlackCat, including “their affiliates, activities, or connections to foreign governments.” .

Russia-based ALPHV/BlackCat is a ransomware-as-a-service company that recruits affiliates (effectively contractors who earn commissions by launching ransomware attacks) and takes a cut of the ransoms paid by victims. Although security researchers have not linked ALPHV/BlackCat to a foreign government, the U.S. State Department hinted in a statement that the group may be “acting at the direction or control of a foreign government,” such as Russia.

The U.S. State Department accuses the prolific ransomware group of targeting U.S. critical infrastructure, including health services.

Last month, an affiliate of the ALPHV/BlackCat gang claimed responsibility for a cyberattack and weeks-long service outage at US health tech giant Change Healthcare, which handles approximately one-third of US patient medical records. The cyberattack compromised much of the U.S. healthcare system’s access to patient records and billing information, causing widespread disruption and delaying the fulfillment of medications, prescriptions and surgical authorizations for weeks.

The affiliate was publicly disclosed after accusing a major ALPHV/BlackCat gang of defrauding contract hackers of $22 million in ransoms, which Change Healthcare allegedly paid to prevent a massive breach of patient records.

The group said ALPHV/BlackCat ran an “exit scam” in which hackers fled with their possessions to avoid paying their affiliates and keep the stolen funds for themselves.

Despite losing its share of ransom demands, the affiliated group claims to still have access to large amounts of stolen sensitive patient data.

Change Healthcare said it had expelled the hackers from its network and restored most of its systems. US health insurance giant UnitedHealth Group, the parent company of Change Healthcare, has not confirmed whether any patient data was stolen.