CareFirst BlueCross BlueShield of Maryland Sues Change Healthcare Over Ransomware Attack
A lawsuit has been filed by a Maryland health insurer against Change Healthcare over its February 2024 ransomware attack that seeks compensation for the financial harm caused by the attack.
CareFirst BlueCross BlueShield of Maryland (CareFirst BCBS), a health insurer serving around 3.5 million people in Maryland and the Washington D.C. metropolitan area, claims to have lost a significant amount of data in the attack. The data was needed to manage its employer health plans and components of its Medicare Advantage business. The attack forced CareFirst BCBS to reallocate $25 million in investment funds to loans, as providers were struggling to operate due to the ransomware attack and prolonged outage.
The Change Healthcare ransomware attack was detected in February 2024, causing an outage of Change Healthcare’s systems that lasted for several weeks. Those systems process around 15 billion transactions each year and interact with the data of approximately 1 in 3 Americans. The outage caused massive disruption to care delivery, and the financial problems experienced by providers due to the disruption to their revenue management cycles are still being felt more than a year after the attack.
The ransomware group behind the attack, ALPHV/BlackCat, stole the protected health information of approximately 190 million individuals, and were paid $22 million to delete the stolen data; however, the data was retained by the affiliate and Change Healthcare faced a second extortion attempt. When that attempt failed, the stolen data was listed for sale.
The CareFirst BCBS lawsuit alleges Change Healthcare was negligent due to having insufficient cybersecurity safeguards to prevent unauthorized access to its systems. The ransomware group used stolen credentials to access a vulnerable Citrix server, which did not have multifactor authentication enabled. CareFirst BCBS is seeking $900,000 in compensatory damages, interest, and attorneys’ fees.
At least 60 lawsuits have been filed against Change Healthcare by affected providers and patients who had their data compromised in the attack. The lawsuits have been consolidated and the lawyers involved in the litigation have been ordered to attend in-person settlement discussions with U.S. Magistrate Judge Dulce J. Foster on April 30, 2025, to negotiate a settlement.
