Gallego Demands UnitedHealth CEO Answer for Recent Cyber-Attack Impacting Arizonans
PHOENIX – Today, Rep. Ruben Gallego (AZ-03) demanded UnitedHealth Group CEO Andrew Witty provide answers regarding the recent cyber-attack that impacted thousands of pharmacies and patients nationwide, including in Arizona.
"I am deeply concerned with the timing of the breach following the discovery of the potential vulnerability early last week and its continuing impacts on Arizonans...Pharmacies across the country, including in Arizona, have been unable to process patients’ insurance, forcing patients to choose between forgoing critical medications or paying out of pocket with the hopes of receiving reimbursement," Rep. Gallego wrote.
Rep. Gallego also expressed concern regarding the two-day window between when Change Healthcare was first made aware of the critical vulnerability and when that vulnerability was exploited, as well as inconsistencies between UnitedHealth’s required disclosure to the Security and Exchange Commission (SEC) and public reporting regarding the perpetrators of the cyber-attack.
To address these concerns, Rep. Gallego requested responses to the following:
- Please provide a detailed timeline of the breach, including when it was first discovered internally, the initial investigation into its scope and source, notification to authorities, and notification to senior leadership at Optum and UnitedHealth.
- What evidence was provided to the SEC or to the Cybersecurity and Infrastructure Security Agency (CISA) in the 24 hours after the incident became known to justify UnitedHealth’s description of a cyber-attack originating from a nation-state associated actor?
- Was anybody at UnitedHealth, Optum, or Change Healthcare aware of the reported vulnerability from ConnectWise regarding ScreenConnect, and, if so, was this vulnerability communicated to anybody in senior leadership at Optum or UnitedHealth?
- Were any actions taken to implement the security fix published by ConnectWise between Monday, February 19th and Wednesday, February 21st?
- How many pharmacy locations in Arizona have been impacted by the Change Healthcare system shutdown?
- How many patients have been forced to either forgo having a prescription filled or have paid out-of-pocket for medications when picking up a prescription?
- What is the current timeline for restoring prescription processing services to pharmacies?
- Was any patient data or Personally Identifiable information accessed during the breach, and, if so, have patients been notified?