Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UnitedHealth says data of 100M stolen in Change Healthcare hack

bleepingcomputer.com

Post reply on HN
Print view View original

11–20 of 41 posts

Re: UnitedHealth says data of 100M stolen in Change Healthcare hack

#11

Post by kmeisthax »

mlsu wrote: post #8

I really don't understand how this level of consolidation has been allowed in the healthcare market. I was affected by this, couldn't get prescriptions filled for 4 days. Turns out I'm not alone -- 100m people? That's 1/3rd of America's population! There is no competition in the marketplace. We need to either nationalize them or break them up. These ransomware groups are small-time compared to a nation-state adversar…

Part of the neoliberal consensus that replaced progressive liberalism in the 1970s and 80s is a revisionist reframing of antitrust law in which all monopolies are judged solely by the yardstick of consumer welfare. Problem is, very few monopolies actually harm consumer welfare. Bigger businesses are able to deliver lower prices - at least initially - because they suck the redundancy out of the market. Ergo, consolidation is good actually and antitrust is self-defeating.

Of course, those prices will creep up eventually, once the causal link between the consolidation and the market power has been sufficiently obscured. Look at "inflation" - every business was able to blame "supply chain issues" (that they caused by removing redundancies) during COVID to extract unthinkable price increases out of the public. Because every business has only two or three real competitors, all of whom have extreme levels of class discipline and will agree to lie their asses off to the public.

This level of consolidation was allowed because your politicians stabbed you in the back in the name of the """free""" market.

Re: UnitedHealth says data of 100M stolen in Change Healthcare hack

#12

Post by oefrha »

kevinmershon wrote: post #2

So would this count as 1 instance or 100M instances of HIPAA violations? Last I checked the penalty is $50k per violation...

It’s *up to* 50k per violation. Like most large scale violations of anything, it’s effectively “we’ll fine whatever we want”.

Re: UnitedHealth says data of 100M stolen in Change Healthcare hack

#13

Post by spoonfeeder006 »

I always wonder that maybe someone can convince these health companies, clinics, etc... to start using Qubes OS for their network connected office computers. Maybe that could prevent a sizeable number of these ransomware attacks?

TLDR Qubes OS is a security focused operating system that is geared towards end users. It relies on isolation via the Xen hypervisor (has much less privileged code than Linux, Windows, or Mac kernels), and uses hardware based virtualization features of the CPU as well. E.g. it prevents a compromised network card from accessing the memory of a trusted virtual machine through DMA attacks as an example

And ultimately it incorporates this isolation into a seamless user interface as well

I'm guessing the primary feature that would protect against ransomware is that it allows on to open suspicious links in disposable VMs

Re: UnitedHealth says data of 100M stolen in Change Healthcare hack

#14

Post by sofixa »

spoonfeeder006 wrote: post #13

I always wonder that maybe someone can convince these health companies, clinics, etc... to start using Qubes OS for their network connected office computers. Maybe that could prevent a sizeable number of these ransomware attacks? TLDR Qubes OS is a security focused operating system that is geared towards end users. It relies on isolation via the Xen hypervisor (has much less privileged code than Linux, Windows, or Ma…

With the move of most enterprise software to web interfaces, this could be realistic for some organisation. Others, especially in healthcare, will have odd legacy thick clients developed in obscure languages decades ago that nobody wants to port.

Re: UnitedHealth says data of 100M stolen in Change Healthcare hack

#15

Post by hsbauauvhabzb »

spoonfeeder006 wrote: post #13

I always wonder that maybe someone can convince these health companies, clinics, etc... to start using Qubes OS for their network connected office computers. Maybe that could prevent a sizeable number of these ransomware attacks? TLDR Qubes OS is a security focused operating system that is geared towards end users. It relies on isolation via the Xen hypervisor (has much less privileged code than Linux, Windows, or Ma…

Has there been any organisation to successfully roll this out, ever?

It’s great for security, but useless from a productivity standpoint.

Re: UnitedHealth says data of 100M stolen in Change Healthcare hack

#16

Post by hulitu »

azinman2 wrote: post #6

At what point can we sue, especially if basic security practices like 2FA are not enabled?

> At what point can we sue, especially if basic security practices like 2FA are not enabled?

And if they are enabled ? Do you think this will make any difference ? We have, at work (Microsoft) 2FA enabled with Windows Hello. At setup it wanted to set a numeric pin. That's all. It asks from time to time about the second factor (Microsoft Authenticator) and that's all.

Re: UnitedHealth says data of 100M stolen in Change Healthcare hack

#17

Post by hulitu »

> UnitedHealth says data of 100M stolen in Change Healthcare hack

"Privacy matters to Change Healthcare, so we follow a privacy framework that helps us to manage and protect your personal information in the products and services we provide."

I guess this speaks for itself. /s

Re: UnitedHealth says data of 100M stolen in Change Healthcare hack

#18

Post by Hilift »

mlsu wrote: post #8

I really don't understand how this level of consolidation has been allowed in the healthcare market. I was affected by this, couldn't get prescriptions filled for 4 days. Turns out I'm not alone -- 100m people? That's 1/3rd of America's population! There is no competition in the marketplace. We need to either nationalize them or break them up. These ransomware groups are small-time compared to a nation-state adversar…

This is one of those companies that has middleware or back office apps that are common to many health care providers. Many different markets have their own unique apps or places where data can accumulate. I remember when paper checks were still used, a small number of companies existed to receive and catalog checks and update the accounts accordingly. I visited some, and they looked like they were spun off from bank(s) to unload the cost of what was going to be a disappearing operation. Really bare bones, disarray, and access to a lot of interesting data. Another app I found interesting was for closing mortgages. There aren't many of those, and the ones that did exist were in a lot of places and were a complete shambles, data everywhere, written in early 2000's.

"Change Healthcare Inc. (known as Emdeon before rebranding in 2015, which followed its acquisition of Change Healthcare) is a provider of revenue and payment cycle management that connects payers, providers, and patients within the U.S. healthcare system. The name also refers to a company founded in 2007 which subsequently became part of the current conglomerate." https://en.wikipedia.org/wiki/Change_Healthcare

Re: UnitedHealth says data of 100M stolen in Change Healthcare hack

#19

Post by sofixa »

kmeisthax wrote: post #11
mlsu wrote: post #8

I really don't understand how this level of consolidation has been allowed in the healthcare market. I was affected by this, couldn't get prescriptions filled for 4 days. Turns out I'm not alone -- 100m people? That's 1/3rd of America's population! There is no competition in the marketplace. We need to either nationalize them or break them up. These ransomware groups are small-time compared to a nation-state adversar…

Part of the neoliberal consensus that replaced progressive liberalism in the 1970s and 80s is a revisionist reframing of antitrust law in which all monopolies are judged solely by the yardstick of consumer welfare. Problem is, very few monopolies actually harm consumer welfare. Bigger businesses are able to deliver lower prices - at least initially - because they suck the redundancy out of the market. Ergo, consolida…

> Look at "inflation" - every business was able to blame "supply chain issues" (that they caused by removing redundancies) during COVID to extract unthinkable price increases out of the public.

Are you implying there were no supply chain difficulties? China wasn't under heavy lockdown for months on end? There weren't ports with months of backlog? Factories weren't closed due to lockdowns or outbreaks all around the world? That civilian aviation ground to almost a complete halt for a few months, and the cargo it used to carry now didn't need to find an alternative route?

Anyone trying to pin a singular reason for the inflation spikes after Covid is at best misinformed and arguing in bad faith. Covid wrecked supply chains, Russia's invasion of Ukraine wrecked a number of important raw materials' markets (oil, gas, nickel, grain, etc), the Houthis' shenanigans impacted the Suez Canal, droughts impacted the Panama canal. Sprinkle a heavy dose corporate greed and voilà, inflation.

Re: UnitedHealth says data of 100M stolen in Change Healthcare hack

#20

Post by pickledoyster »

sofixa wrote: post #19
kmeisthax wrote: post #11

Earlier quoted context omitted.

Part of the neoliberal consensus that replaced progressive liberalism in the 1970s and 80s is a revisionist reframing of antitrust law in which all monopolies are judged solely by the yardstick of consumer welfare. Problem is, very few monopolies actually harm consumer welfare. Bigger businesses are able to deliver lower prices - at least initially - because they suck the redundancy out of the market. Ergo, consolida…

> Look at "inflation" - every business was able to blame "supply chain issues" (that they caused by removing redundancies) during COVID to extract unthinkable price increases out of the public. Are you implying there were no supply chain difficulties? China wasn't under heavy lockdown for months on end? There weren't ports with months of backlog? Factories weren't closed due to lockdowns or outbreaks all around the w…

"The biggest study of ‘greedflation’ yet looked at 1,300 corporations to find many of them were lying to you about inflation" – https://fortune.com/europe/2023/12/08/greedflation-study/
Post reply on HN