The healthcare giant reported unfavorable effects amounting to $872 million, resulting from the cyberattack that occurred on February 21.

The attack, which caused a shutdown of operations at hospitals and pharmacies for over a week, has proven costly for UnitedHealth. The $872 million includes the business disruption impacts of Change Healthcare, but it does not encompass the direct response costs incurred as a result of the cyberattack, suggesting that any ransom paid to the hackers is not included in this figure.

UnitedHealth confirmed that the cybercriminals behind the attack were a Russia-based ransomware gang known as ALPHV or BlackCat. The group claimed responsibility for the attack and stated that they had stolen more than six terabytes of sensitive medical records.

While UnitedHealth did not disclose the ransom amount paid to the hackers for the restoration of their systems, media reports, including Wired Magazine, indicate that a payment of $22 million in bitcoin was made to BlackCat.

Ransomware attacks have become increasingly common within the healthcare industry, causing considerable havoc and disruptions. A study published in JAMA Health Forum in December 2022 revealed that the number of ransomware attacks on hospitals and healthcare providers doubled from 2016 to 2021.

The impact of cyberattacks on healthcare systems has also been thoroughly examined. A study published in May 2023 in JAMA Network Open found that waiting times, median length of stay, and incidents of patients leaving against medical advice all increased after an attack. Additionally, a preprint by researchers from the University of Minnesota in October 2023 noted a nearly 21% increase in mortality for patients in a ransomware-affected hospital.

During an earnings call, UnitedHealth CEO Andrew Witty described the Change Healthcare incident as a deliberate attack on the U.S. health system, specifically designed to cause maximum damage. The company estimates that the cyberattack will cost UnitedHealth between $1.35 billion and $1.6 billion this year, as projected in its earnings report.

Despite the significant financial impact of the cyberattack, UnitedHealth Group reported impressive first-quarter results, surpassing analysts' expectations. The company recorded $99.8 billion in revenue and a per-share profit of $6.91, exceeding the forecasted revenue of $99.2 billion and per-share profit of $6.61.

"We got through that very well in terms of remediation and building back to (full) function," stated Witty, emphasizing the company's efforts to restore operations. Approximately 80% of Change Healthcare's pharmacy claims and payment computer systems have been fully restored since the cyberattack, according to Optum Insight CEO Roger Connor.

As cyber threats persist, healthcare organizations continue to face mounting challenges in safeguarding sensitive patient data and ensuring the resilience of their systems against potential attacks. The UnitedHealth Group's experience serves as a stark reminder of the high costs and disruptions associated with cyberattacks in the healthcare industry.