UnitedHealth has disclosed that its subsidiary, Change Healthcare, was victim to a BlackCat ransomware attack after attackers used stolen credentials to access the company's Citrix remote access service, which lacked multi-factor authentication. The breach, occurring in late February 2024, led to significant operational disruptions, affecting vital services such as payment processing and insurance claims, with financial damages estimated at $872 million. UnitedHealth later admitted to paying a ransom in an effort to protect compromised data, despite the details of the attack not being fully disclosed. The organization has undertaken extensive remediation efforts, including system upgrades and network rebuilds, aimed at restoring affected services and enhancing security measures. Additionally, an update mentions that stolen Change Healthcare employee Citrix credentials were detected on February 8 by Hudson Rock's threat intelligence platform, though it's unclear if these credentials were directly linked to the ransomware attack.

Change Healthcare hacked using stolen Citrix account with no MFA BleepingComputer

The U.S. Securities and Exchange Commission (SEC) now mandates public companies to disclose the cybersecurity expertise present within their boards of directors, aiming to enhance oversight and management of cyber risks. This regulatory change underscores the growing importance of cyber resilience amid increasing data breaches and emphasizes the role of board members in ensuring organizations are prepared for cyberattacks. Keri Pearlson's research highlights the shift from a protection-oriented cybersecurity approach to one focused on resilience, proposing the adoption of a Board Level Balanced Scorecard for Cyber Resilience (BSCR) to facilitate strategic discussions on cyber risk management. This scorecard helps quantify and address risks across technology, financial, organizational, and supply chain dimensions, aiming to foster a more resilient business approach to cyber threats. Pearlson also advocates for executive education to bolster non-technical leaders' understanding of cybersecurity, emphasizing the need for boards to foster cyber resilience rather than solely focusing on preventive measures.

Now corporate boards have responsibility for cybersecurity, too MIT News

David Carmouche of Walmart Health expresses deep disappointment over the announcement to close Walmart health centers and virtual care services. He praises the dedication of the impacted associates and affirms that their efforts in addressing healthcare accessibility, convenience, and affordability have been crucial. Carmouche assures continued support for patients during the transition to new providers and acknowledges the hard work and resilience of his team, despite the project not achieving its desired outcome. He closes by reflecting on the challenges of retail healthcare and maintaining optimism about the positive impact large retailers can have in this field.

David Carmouche, MD on LinkedIn: Walmart to shutter health centers, virtual care service in latest failed… | 138 comments cnbc.com

The Federal Trade Commission (FTC) has passed a new rule that prohibits employers from using non-compete agreements with workers, except for a narrower application to top executives. This FTC final rule is part of a broader scrutiny of non-competes which research shows tend to impede market competition, suppress worker earnings, and hinder business innovation. Predictably, the rule has generated significant backlash, particularly from healthcare organizations, leading to lawsuits and contention about the FTC’s authority. With staggered enforcement dates for existing and new agreements, the rule reflects an intent to increase labor market fluidity and decrease healthcare costs, aligning with empirical research promoting economic efficiency and competition. However, its immediate future is clouded by legal challenges and dissenting views from within various industry sectors, especially healthcare, as debates about its broader implications continue to unfold.

Four Implicit Messages to Healthcare in the FTC Non-Compete Rule - Paul Keckley paulkeckley.com