Change Healthcare’s ransomware attack costs edge toward $1B so far

UnitedHealth, parent company of ransomware-besieged Change Healthcare, says the total costs of tending to the February cyberattack for the first calendar quarter of 2024 currently stands at $872 million.

That's on top of the amount in advance funding and interest-free loans UnitedHealth provided to support care providers reeling from the disruption, a sum said to be north of $6 billion.

In its results for the quarter ended March 31, filed today, UnitedHealth stated that the total impact on the company from the attack in Q1 was $0.74 per share, which is expected to rise to a sum between $1.15 and $1.35 per share by the end of the year.

The remediation efforts spent on the attack are ongoing, so the total costs related to business disruption and repairs are likely to exceed $1 billion over time, potentially including the reported $22 million payment made to the ALPHV/BlackCat-affiliated criminals behind the attack.

It's a charge that eclipsed that of casino group MGM, which didn't pay a ransom following an attack on its systems last year, and which faces recovery costs of $100 million to rebuild its systems and paying for the fallout from outages, operational disruptions, allegedly leaked data and more.

The financial results mark the first time UnitedHealth has divulged the direct and business costs of the attack, which floored hospitals and pharmacies across the US, both in terms of cashflow and their ability to provide care.

UnitedHealth reported first-quarter revenues at $7.9 billion. It made a total Q1 net loss of $1.221 billion for the quarter. It also provided an "adjusted" quarterly earnings per share figure of $6.91 that confusingly includes the $0.25 in "business disruption impacts" but excludes both the sale of its Brazil ops and the costs of its direct response to the cyberattack, which amounted to "$0.49 per share" for the quarter. Those costs are actually going to rise, with UnitedHealth estimating those "direct response" costs are going to hit shareholders to the tune of $0.85 to $0.95 per share for the full year 2024.

The company warned that, financially, the total cost of the cyberattack is estimated to be between $1.35 billion and $1.6 billion for calendar year 2024.

UnitedHealth's accountants will be pleased that the company share price rose 7.5 percent in premarket trading following the release of its results – a welcome boost following the heavy dip taken since the attack.

"The core story at UnitedHealth Group remains our colleagues delivering improved experiences for the people we serve and driving balanced growth even while swiftly and effectively addressing the attack on Change Healthcare," said Andrew Witty, chief executive officer at UnitedHealth Group.

Change Healthcare is still very much feeling the effects of the incident it suffered in March, in part due to the double scumbaggery of ALPHV pulling an exit scam shortly after the ransom was allegedly paid. 

It's believed that the affiliate or affiliates who carried out the attack on Change never received their cut of the profits, so switched allegiances to RansomHub and are once again extorting Change Healthcare using the same data they stole originally. ®