UnitedHealth CEO Andrew Witty will tell US lawmakers Wednesday the cyber-criminals who hit Change Healthcare with ransomware used stolen credentials t

UnitedHealth CEO: 'Decision to pay ransom was mine'

submited by

Style Pass

2024-04-30 20:00:03

UnitedHealth CEO Andrew Witty will tell US lawmakers Wednesday the cyber-criminals who hit Change Healthcare with ransomware used stolen credentials to remotely access a Citrix portal that didn't have multi-factor authentication enabled.

Once they were into that management system, the miscreants were able to move through the network to steal data and deploy extortionware.

As well as that admission, Witty is also expected to confirm making a payment to the extortionists, which reportedly cost the healthcare giant $22 million.

"As chief executive officer, the decision to pay a ransom was mine," as Witty put it in written testimony [PDF] he will deliver to the House Energy and Commerce Committee on May 1. "This was one of the hardest decisions I've ever had to make. And I wouldn't wish it on anyone."

In addition to the House committee, the US Senate Finance Committee is holding a hearing Wednesday about the Change Healthcare cyberattack. Witty will also testify at this inquiry.