Before the shooting in Midtown Manhattan on Wednesday, United Healthcare had been managing another crisis: a ransomware hack that struck a subsidiary and led to the leak of sensitive health-care information for millions of Americans.
The attack occurred in February at Change Healthcare, a subsidiary of the giant United Healthcare, which is deeply embedded in the U.S. health-care system: It processes about a third of all the country’s patient records and conducts about 15 billion transactions a year. The hack disrupted medical facilities across the country, which could not get paid even after the firm paid an unspecified ransom to the group.
Wednesday’s victim, Brian Thompson, headed a different subsidiary of United Healthcare Group, the parent company, and there was no indication that the hack was linked to what appeared to be a targeted killing. But clearly it will be part of the investigation, because the scope and scale of the hack infuriated patients whose data was revealed, health care groups that couldn’t get paid and the hackers themselves, who came under intense investigation.
In May the chief executive of United Healthcare, Andrew Witty, came under bipartisan criticism for how the company handled the attack. He acknowledged that lax security had enabled the hackers to enter Change Healthcare’s systems, and that United had failed to cover payments for providers in the months after the hack.
The company has said relatively little about the damage, and Senator Ron Wyden, an Oregon Democrat, said the “hack is a dire warning about the consequences of ‘too-big-to-fail’ mega corporations gobbling up larger and larger shares of the health care system.”
The attack was part of a larger pattern of ransomware cases, many originating in Russia, that have struck hospitals, insurers and cities across the United States.
A correction was made on Dec. 4, 2024:
A picture caption with an earlier version of this article, relying on information from The Associated Press, incorrectly described the flags in front of United Healthcare’s corporate headquarters. They had been lowered days earlier; they were not lowered on Wednesday in honor of Brian Thompson’s death.
