US to probe Change Healthcare's data protection standards as lawsuits mount

Change Healthcare is being investigated over the alleged 6 TB data theft by the ALPHV ransomware group as it continues recovery efforts. The US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) wrote to the healthcare IT company this week informing it that a formal inquiry into its data protection practices will soon begin. The OCR cited the "unprecedented magnitude of this cyberattack" in its letter, referring to the widespread and substantial disruption the incident has had on thousands of pharmacies and hospitals across the US. Change's software is used for carrying out various critical functions including processing insurance claims, prescriptions, and billing operations. It's also the entity responsible for enforcing the data protection and privacy rules set out in the Health Insurance Portability and Accountability Act 1996. The investigation will focus on the level of compliance with these rules and whether protected health information was breached. The ALPHV/BlackCat ransomware group, which recently shut down via an exit scam, claimed responsibility for the February attack that would end up being one of its very last. It claimed to have stolen 6 TB of data, an assertion that Change Healthcare declined to confirm when asked about it. Security researchers also spotted a $22 million Bitcoin payment made to a known ALPHV crypto wallet on March 1. Change also dodged our questioning about that. It's unclear exactly what data was stolen by the crimi...