WASHINGTON, March 4 (Reuters) - A post on a hacker forumpopular with cybercriminals has claimed UnitedHealth Group ( UNH )paid $22 million in a bid to recover access to data andsystems encrypted by the "Blackcat" ransomware gang, accordingto two researchers.
Neither UnitedHealth ( UNH ) nor the hackers involved have commentedon the alleged ransom payment, but a cryptocurrency tracing firmpartially corroborated the claim on Monday.
It is not uncommon for large companies that have beenvictimized by ransomware gangs to decide to pay the hackers toregain control of their networks, especially in instances wherea significant disruption to customers and partners occurred.
The forum post, dated Sunday, said a partner of Blackcat wasresponsible for the intrusion into UnitedHealth ( UNH ). The message,allegedly from the partner, included a link showing that someonehad moved about 350 bitcoins, now worth about $23 million as thevalue of the cryptocurrency rises, from one digital currencywallet to another.
The owner or owners of the respective wallets is notpublicly available, but blockchain analysis firm TRM Labs saidthe destination of the funds was "associated with AlphV," alsoknown as Blackcat, noting it had seen that address used tocollect ransom payments from other AlphV victims.
Asked whether it had paid the ransom, UnitedHealth ( UNH ) said onlythat it was "focused on the investigation and the recovery."
Blackcat has not responded to repeated messages from Reuterssent over several days. Reuters could not immediately determinehow to reach the purported partner hacker group or to access thecybercrime forum where the post was made, although it was ableto view screenshots taken independently by two researchers,including Recorded Future's Dmitry Smilyanets.
The break-in at UnitedHealth's ( UNH ) Change Healthcare unit, whichhas sparked disruption across the United States, has been theobject of online intrigue. Blackcat claimed last week that ithad stolen millions of sensitive records in the hack, only toquickly delete its post without explanation.
Meanwhile, the pain has continued to spread across the U.S.medical system as Change Healthcare's billing services remainparalyzed. The American Medical Association on Monday asked theBiden administration to make emergency funds available tophysicians hurt by the outage.