ISMG Editors: Unpacking the Change Healthcare Attack Saga

Transcript

This transcript has been edited and refined for clarity.

Anna Delaney: Hello and welcome to the ISMG Editors' Panel. I'm Anna Delaney, and in this episode, we're discussing the ongoing developments in the Change Healthcare cyberattack, positive signs of economic recovery in the cybersecurity sector and how AI is shaking up supply chain security. The team today includes Marianne Kolbasuk McGee, executive editor of HealthcareInfoSecurity; Tony Morbin, executive news editor of the EU; and Michael Novinson, managing editor for ISMG business. Excellent to see you all.

Marianne McGee: Hi, Anna!

Delaney: Marianne, the Change Healthcare, cyberattack saga continues to evolve very rapidly. So where are we now? Can you share the latest developments?

McGee: Sure, we're not quite two months into the attack saga, but it does continue to get messier with new developments popping up all the time. And here's just a little bit of background that will bring us to what the latest is. A few weeks back on an affiliate of the ransomware group BlackCat, also known as AlphV, claimed it was behind the attack on Change Healthcare, stealing several terabytes of data. And that Change Healthcare's parent company paid a $22 million ransom for decrypter key and to prevent a data loss. Now the affiliate then claimed that BlackCat administrators had kept the full $22 million and did not give him or them the share of the ransomware cut that they were supposed to get for stealing the data. Now UnitedHealth Group has publicly acknowledged that BlackCat's claims were made but they didn't admit anything about paying a ransom. Now, it's been rumored that UnitedHealth got a decrypter key from BlackCat but did not get the stolen data back because the affiliate was stiffed. Now in this latest round of back and forth, a second cybercrime group this week, a relatively new group called RansomHub has threatened UnitedHealth Group saying that it would sell to the highest bidder four terabytes of highly sensitive data that was stolen by AlphV or BlackCat in the Change Healthcare attack. RansomHub claims that the stolen Change Healthcare data that they have pertains to millions of active U.S. military and navy personnel, medical and dental records, payment and claims information, patient social security numbers, and 3,000+ source code files for Change Healthcare IT solutions. Now threat analysts are speculating that this RansomHub might be a rebranding of BlackHat, or it may be a new moniker under which the stiffed BlackCat affiliate is now working and still trying to get paid a ransom for the stolen Change Healthcare data. Now last month shortly after BlackCat's affiliate claimed it was stiffed out of their share of the ransom BlackCat's Tor-based data leak website shut down and its webpage claim that the FBI had seized the site as part of a coordinated law enforcement action taken against BlackCat. Now, while the a joint law enforcement operation did indeed cease BlackCat's infrastructure last December, it only temporarily disrupted the group, and law enforcement denied that they've taken the operation down a second time since the wake of the Change Healthcare attack, which has fueled speculation that BlackCat was pulling an exit scam. So now it's likely that this RansomHub group has at least some historical ties to BlackCat or at least to the stiffed affiliate. At least that's what threat analysts speculate. In the meantime, UnitedHealth Group, which is again Change's parent company, says the company is making progress in restoring the 100+ IT products and services that were taken offline after the February 1 attack. Some services are back online, but others are still being restored over the next few weeks, according to the company's latest timeline. Now, many of the healthcare entities affected by the claims processing and other business process disruptions that happened, are still slogging through piles of work, and probably will continue to do so for quite a while in order to catch up with what couldn't be processed during the last few weeks. Also, UnitedHealth Group has not yet disclosed the extent of a data breach that potentially occurred in the attack. But the company is already facing at least two dozen propose federal class action lawsuits that were filed by individuals who claim that their data was compromised, and by healthcare providers who have been affected by the incident in terms of disruption. So we'll have to see what happens next. But there's always a new bomb that seems to drop every week, it seems.

Delaney: And on a very basic level, I think this highlights all the broad and complex effects that cyberattacks can have in the healthcare sector considering the scale of the breach, the nature of the data involved, what are the potential legal and regulatory implications for Change Healthcare and UnitedHealth Group, do you think Marianne?

McGee: Well, from a legal perspective again, we have these lawsuits that have been filed, I'm sure there'll be many more. From the regulatory standpoint the Department of Health and Human Services, about a month - not month - I guess, it was like March 13 which was a few weeks after the attack jumped in and said, oh, we're investigating, we're going to investigate to see what data is compromised which was very proactive for the Department of Health and Human Services, which typically waits until a breach is reported before they start investigating. And then also, there's been some changes already, sort of temporary changes with some of the regulations for the Centers of Medicaid and Medicare and Medicaid Services in terms of advancing some medicare payments to organizations who haven't been able to file claims. And then there's also been sort of a resurfacing of discussion about whether UnitedHealth Group, and the Change acquisition that the company made two years ago is just makes you got this company to be too big. And issues involving IT consolidation in the healthcare sector before UnitedHealth Group acquired Change in 2022, there was some concern by the U.S. Department of Justice and other regulators about maybe this was not such a good idea, but the deal was able to go through anyway. So now, maybe there's going to be some second guessing, or perhaps sort of a reevaluation, for any of these types of acquisitions in the industry going forward. You don't want anybody be too big and too dependent upon when something like this happens.

Delaney: We probably won't be the last time you discuss this story with us. But thank you so much, Marianne, for that update. Michael, you bear good news this week, I think. Too early signs of economic recovery in the cybersecurity sector. Is it true?

Michael Novinson: It is true, and so the first time I can say this for quite some time here and I'll walk you through each of them. So first, last week, we saw a Rubrik, who's in that data protection world, they have formally filed for an IPO. That means they filed a registration statement in S-1 with the Securities and Exchange Commission, essentially laying out all their financials and detailing their plans to go public. Why this is notable, among other things, even beyond Rubrik, is that it's the first time we've seen a cybersecurity company file for an IPO dating all the way back to August of 2021. So that's a good long time. That was for draft to filed back then, to give you a sense of how the market change. They were in public for much more than about 18 months or so before Thoma Bravo took them private again, brought them together with Ping Identity. So they're no longer even in the public market. So an early sign of recovery, it's certainly there's a whole lot of companies in cybersecurity that were thinking, oh, we could go public in 2022. We can go public in 2023. We could go public in 2024. None of them have done so. They've all been waiting and waiting for somebody else to take that cold icy plunge first. Looks like it's going to be Rubrik. Quention is how instructive is it going to be for everybody else, because Rubrik is a very atypical company. I'll tell you why. So Rubrik has about $650 million in revenue, which is absolutely enormous for a company that's going public for the first time call that a startup is kind of absurd. That's a very large company, they employ 3,500 people. So they're not what anybody would conceive of as a startup in addition to that, they're losing about $350 million every year. So, if you're ... any of these other companies that are thinking about a startup, your Cato Networks, your Sleek, your Claroty, your Wiz, on all that you are operating off of a much smaller base of revenue. You have far fewer employees, and will hopefully you're also losing less money. So how well or poorly Rubrik does may not necessarily be that instructive for them. So in terms of Rubrik itself, to give you a sense of how unprecedented these numbers are their revenue figure at $650 million, that's two and a half times larger than anybody we've ever seen go public from cybersecurity, for top line revenue that would have been Tenable. Back in 2018, they had just north of a quarter billion in revenue. So this is unprecedented from size, and from a loss standpoint, also orders of magnitude larger. Mandiant was the company that was deepest in the red when they went public as FireEye, a decade ago. And yeah as it turned out, they never became profitable before getting acquired by Google in 2022. So yeah, it'll be interesting to see how they react. Rubrik is growing pretty slowly right now, to mid-single digit by 5% growth. Certainly some of that is large base numbers, and it's a large company, log bought percentages, it's hard to maintain high percentage growth as your original figures get higher. But some of this is also that they're going through a business model transition that they historically did on-premises license based on sales, which means that the revenues recognized up front at the time that the product is sold, you recognize all the revenue. They are now switching to a subscription-based model, they're in the process of doing so. So when it comes to a subscription, you're essentially recognizing the revenue as it comes in. So the customer is paying a certain amount each month. And that's when you're recognizing the revenue. So it's leading ... what they're saying is, it's leading to a lot of deferred revenue, but they're also having to assume all the costs for it up front. So it's not helping from a profitability standpoint. So their argument is in a couple of years that that'll shake out and you'll see the real growth that they're seeing, which is higher than 5%. the other argument would be if that was the case, why not just wait till you're through that transition to go public? So it'll be interesting to see how that plays out. But yeah, it's exciting to see someone back in there certainly in cybersecurity, if we think about the biggest, the most successful cybersecurity companies - Palo Alto Networks, CrowdStrike, Zscaler Okta - , they're all public. That's where the creme de la creme play. So it'll be interesting to see if Rubrik is able to join them. So that's piece number one. Piece number two is a unicorn valuation. So these are companies that are worth more than a billion dollars. So up until COVID, we had seen the 10 companies achieve unicorn valuations as cybersecurity startups. Then, after the initial COVID freak out when people realized, oh, gee COVID is good for cybersecurity, we saw this unprecedented boom. So between the fall of 2020 and June of 2022, we saw 48 newly minted cybersecurity unicorns, which is absolutely crazy and is completely above all, and a lot of those shouldn't have ever done unicorns, but they're here. And then after that, we saw the economic slowdown that took effect in spring 2022. We saw companies ... we saw investors valuing profitability more focused more on performance rather than potential. And we hadn't seen a single new unicorn since June of 2022. It was a company called a Bento, and when you and Tom and Mat were at RSA for the first time together that day became a unicorn. And that was the case all the way until yesterday or Tuesday. So on Tuesday Cyera, who is in data security posture management, announced a $300 million funding round and a $1.4 billion valuation that's nearly triple the valuation they received just a year ago in June of 2023, when they got valued at ... a report said $500 million on their previous funding round. So impressive to do and difficult economic times. Speak some to the quality of the company, speaks some to the states that they play in. So to start with the ladder here, they're in this data security posture management space. And certainly, from the standpoint of investors, there's a lot of opportunity around data security, because if you're thinking about historically what a data security look like, that was the data loss protection, data loss prevention (DLP), so those are some pretty old companies, we're talking about Symantec, we're talking about Digital Guardian, we're talking about what was McAfee now Trellix, we're talking about Forcepoint. So it's a pretty outdated technology. But, and there's certainly with the rise of AI, with the rise of cloud computing, there's a need to protect data. But there's also a need for more modern architectures to do so. So we've seen a number of startups in the past maybe three or four years, oriented around this idea of data security posture management, or trying to get visibility into data, even that which no longer resides inside your own data center. So there was a number of them, a number of them got acquired over the past year. So we've seen IBM make an acquisition. And then we saw a Rubrik buy Laminar. We've seen CrowdStrike make an acquisition there, we've seen Palo Alto Networks make an acquisition there. And I think that there's some recognition that perhaps Cyera is a market leader there that Cyera has got bigger, faster than all of those companies that got acquired. So they're going to be the ones who are going to try to go forward independently, perhaps be the next great public company that CrowdStrike and data security, if you will, and in a couple of years. But yeah they're growing fast, I know, their goal with the money is to expand that portfolio. So to move from just doing data security, posture, management to getting into DDR - data detection and response. So to stop real-time threats to data and to be able to remediate them. So to move from that visibility into the security operation center and be able to take real-time action, when there are issues involving data. So again, two positive signs. It'll be interesting. Again, I think the thresholds are much, much higher to go public and to get a unicorn valuations. I don't think there's going to be tons of companies doing either. I think the pace is going to be much slower than we saw in the bubble of 2021. But it will be interesting, certainly to see who's next.

Delaney: And as you say, Cyera have made a choice to stay independent, what do you think the effects of this decision might be compared to other vendors who might have merged or been acquired?

Novinson: I think there's a recognition that , the public market can only sustain one fantastic vendor in each space, keeping in mind, of course, that if you're public, you're almost certainly competing against Microsoft, who's doing more and more things in security every day. So if you think about endpoint security, you have CrowdStrike's the creme vendor. Certainly SentinelOne's doing it there, too. We'll see what the future holds for them. You think about SASE and Zscaler. You think about identity, it's Okta. A lot of the other identity players got taken private. So I think investors are recognizing that, in each security technology category, there's space for one, fantastic standalone, pure play public company. And I think companies were taking a look at their picture and realizing that, well, Cyera got bigger, faster. They're doing more, they have more blue chip customers, and we need to find a path to exit. So I think that's some of what we saw happen. And I think certainly there's pressure for those companies that , if you're thinking about who's going to be a good technology buyer there's Palo Alto Networks, there's CrowdStrike, depending on what you do, maybe they're Zscalar, maybe Okta, maybe SentinelOne. But there's only a handful of those pureplay security companies who are kind of scooping up doing these kinds of tuck in acquisitions. So if you wait too long, and those companies and Palo and CrowdStrike have already made their buys at the SPM, that leaves your options for you. So unless you think you're going to be able to survive in the longterm as a standalone company, there's increased pressure to find an exit, which is typically that strategic buyer and other technology company. So yeah will Cyera eventially become the next great public data security company? I certainly think they have a chance certainly investors who have access to all kinds of proprietary data I don't have. They're giving them a $1.4 billion valuation in this economy. So yeah I think we've seen a calling in the market at least. And certainly if you think about spaces like cloud security, where you have Wiz, almost certainly positioned to be the next great company in that space. The next great public company, what does that mean for lacework in Orca, and Aqua and Sysdig and all of those other CNET companies? What what's the future for them? And I think that'll be interesting to watch shake out.

Delaney: Very good. Well, thank you, Michael, for your thorough insight.

Novinson: Of course, you're welcome.

Delaney: Tony, you're looking at how AI is shaking up supply chain security and software development, opening the door to new vulnerabilities. So what's your take on this evolving risk landscape?

Tony Morbin: As you say, everyone's now aware that for all the benefits and productivity gains that generative AI brings, it is accompanied by a variety of potential and actual increased threats to our security. Now, one of the most basic of things is whether or not we can trust the AI that we're using, either because it might be flawed, or because it might have been subverted by attackers. There was a worrying demonstration of how real this threat is. Reported earlier this month by our colleague Rashmi Ramesh, when she described how researcher deliberately exploited AI hallucinations to distribute a fake version of a non-existent software library. In this particular case, there was a researcher Bar Lanyado of Lasso Security. He noticed how chatbots were calling for a non-existent Python package, dubbed huggingface-cli. He wondered what would happen if he created the non-existent package. So he loaded an empty package with that name and uploaded it to various systems. Now, several large companies used or recommended the fake package in their repositories, including Alibaba, and more than 35,000 authentic downloads were made in just three months. Most developers were already using AI coding tools, including ChatGPT, and they tend to trust the recommendations were packaged that these tools give them, and then they copy and paste them often without checking the answers. Now Lanyado said that he expected OpenAI and similar models to address the challenge of hallucinating answers, but his research unequivocally revealed that they haven't done so. Many of these hallucinated packages couldn't be exploited by hackers due to issues such as pointing to domains that were already taken, but others could be and there's quite a lot to choose from. When he asked various AIs via their APIs to find hallucinated packages, he found that the two GPT models and cohere produced hallucinated output around 20% of the time, and Gemini did so 64% of the time. When it comes to AI use, we clearly need to strengthen our supply chain checks. In particular, developers are going to need to cross verify information when using LLMs and open-source software. Developers need to look at the details in the package repository, check the published dates, the comments the maintainers, the community and how many downloads and lookout for suspicious signs before downloading. Unfortunately, despite calls for SBOMs in the U.S. and for greater supply chain transparency elsewhere, we're already failing when it comes to securing the software supply chain, let alone the AI supply chain. There have been so many successful breaches initiated in the supply chain, as demonstrated by the recent backdooring of the Linux open-source compression software XZ, discussed on this program by our colleague, Mat Schwartz. While gaining visibility of supplier risk should be a top priority for all businesses in the EU, in the U.K., we've seen the government's newly published cyber breaches survey 2024, which found that only 11% of businesses are reviewing the risks posed by their immediate suppliers, and just 6% look at their wider supply chain. The large businesses who are investing more in cybersecurity, there's been a dip in both immediate and wider supply chain risk analysis. Organizations need to prioritize monitoring, assess the performance and security posture of third parties and address any security issues or gaps. As a matter of urgency, suppliers need to be held to the same security standards and policies as your own organization. Yet, few businesses enforces within their contracts with third parties. They need to ensure they have the policies and procedures that meet their own standards, the quality assurance in place. Critical infrastructure in particular can't just award contracts on the basis of the lowest bid. We also saw at the same U.K. survey, that three quarters of businesses put cybersecurity as a high priority for senior management. But the converse of that means that 25% of board-level leaders in the U.K. aren't placing high enough importance on security, let alone AI security.

Delaney: But it is a challenge, of course, Tony, isn't it because we don't want to lose out on the innovation these tools bring. So how do you think developers, companies can protect against these risks without losing out on the advantages of AI tools?

Morbin: I don't think it's an option to not use AI. People are calling for the latest application within companies. They want their own products out yesterday. So it's a case of how do we secure it because we have to use it. And that means using a mixture of tools, policies, procedures. So you need to, first of all, make sure that people are aware of the problem that not all AIs are the same, that some are going to be more vulnerable than others. ChatGPT-3 is more liable to leak information and ChatGPT-4. You can audit what you're getting, you can ... there are tools there to check dependencies and everything else within the AI that you ingress, before you bring it into your system. You have policies at the same place as to which ones you are going to allow to use. And you make sure that staff are aware of these problems as well. But it is checking, checking, checking and implementing best practice that you would have done with normal supply chain. And whilst that was already complex with dependencies of open-source elements, it's even more complex with AI. But that doesn't give you any excuse to not do it, because the consequences of not doing it are just so great.

Delaney: It's a fascinating topic. Thanks, Tony, for bringing it to the panel. And finally, just for fun, imagine a world where our furry feathered or scaled companions could protect us not just physically, but in the digital realm too. If pets could be trained to detect cyber threats, Which animal do you think would be make the best cybersecurity defender?

McGee: I would say in some dogs, because are some dogs that supposedly can detect things like cancer in some patients. But if you're a dog, like my dog, you'll have a lot of false alarms barking at everything. So it's pros and cons with that.

Delaney: Yeah, I see that.

Novinson: Michael, good. Sounds good. I'll give you a serious one and a silly one. I don't know how serious any of this is. But let's do about so for the serious one. I'll say a cat, I do have three of them. But given their night vision, I think that they should have no issue seeing into the dark web. And for my silly one, I'm going to give you a pet squid. I don't know who has a pet squid. But who needs encryption when you can shoot in ink at your enemies. So pet squid all the way.

Morbin: Love them other than Very good? Well, I was thinking along the lines of cybersecurity defender needing resilience. So one creature with a proven ability to overcome setbacks and try again, is a spider. Also, they already understand monitoring the web for anomalies and detecting intruders. And many of them also have a strong deterrence capability, even if we mostly don't currently use attack back much in this industry.

Delaney: The web, the dark web. That's very good. Thank you. Tony, have you thought about that one? Well, my chosen one similar, lots of lots of tentacles and octopus. They're very intelligent. They're able to solve puzzles and there are many Ansel would make the ultimate multi-tasking security administrators. Well, this has been a lot of fun, very informative. Thank you so much for your insight, everyone.

Morbin: Thank you. Thanks.

Delaney: Thanks so much for watching. Until next time.