UnitedHealth Group said Thursday that one of its subsidiaries was hit this week by a cyberattack from an actor with a suspected nation-state association.
The Minnetonka-based health care company said it isolated the affected information technology systems and contained, assessed and remedied the problem.
UnitedHealth Group did not specify the functions of the affected systems, but Rhode Island-based CVS Health — one of the nation's largest pharmacy operators — said some of its business operations were affected by the network interruption. CVS Health said there was no indication that its systems had been compromised.
"We're continuing to fill prescriptions, but in certain cases we are not able to process insurance claims, which our business continuity plan is addressing to ensure patients continue to have access to their medications," the company said in a statement to the Star Tribune.
In a regulatory filing Thursday, UnitedHealth Group said it learned Wednesday of a "nation-state associated cyber security threat actor" that had accessed some information technology systems at Change Healthcare, a business unit that's part of the company's OptumInsight division.
UnitedHealth Group said it believes the network interruption was specific to Change Healthcare. The company said all of its other systems were operational.
"The company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time," UnitedHealth Group said in its filing. "The company has retained leading security experts, is working with law enforcement and notified customers, clients and certain government agencies."
Illinois-based Walgreens said the vast majority of prescriptions at its pharmacies were not affected.
"For the small percentage that may be affected, we have procedures in place so that we can continue to process and fill these prescriptions with minimal delay or interruption," the company said.
UnitedHealth Group is providing regular updates on a newly launched website.
"The disruption is expected to last at least through the day," the company posted around 2:45 p.m. "We will provide updates as more information becomes available."
