Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Senators studied AI for a year. Critics call the result ‘pathetic.’

Google’s AI answers could come back to bite it

Cruise settles with person dragged under one of its robotaxis

Bryce Harper, Joey Gallo and a bond forged by baseball since they were kids

Rating every game on the Commanders’ 2024 schedule

The 34 best things to do in D.C. this weekend and next week

Tariffs against China hamstring the transition to a clean energy future

The Post’s choices in Northern Virginia’s U.S. House primaries

States see legalized sports betting as a tax windfall — but at what cost?

Ask Amy: Retired couple misses social activities since the pandemic

Miss Manners: Longtime friends lose minds over canceled dinner plans

Carolyn Hax: After holiday meals, guests rush the kitchen to claim the leftovers

Look to the cloud to protect the life documents saved on your computer

Can you spot bad financial advice on TikTok? Take our quiz.

5 myths about Social Security as the program faces a funding crisis

Only in the surreal Fox universe can James Comer be treated as credible

Trump’s ‘they’re out to get me’ campaign and its enablers

Voters key to past Democratic wins are skeptical and undermotivated

Puppy abandoned with heart-rending note is adopted, named Minerva

Man, 91, shocks tiny firehouse with $500K gift: ‘Nobody knew how much I’d saved’

Retired cop meets abandoned baby he helped 23 years ago: ‘What are the odds?’

CNN gets a presidential debate — and a much-needed win

Netflix will air NFL’s Christmas games, a major step for streaming service

Sam Feist, longtime CNN executive, will become CEO of C-SPAN

Second Russian invasion of Kharkiv caught Ukraine unprepared

Russia seizes more land than Ukraine liberated in 2023 counteroffensive

Kenyan president aims to attract green investment during U.S. visit

6 Airbnb red flags to spot before you make a booking mistake

Some cruise prices are about to get a little more clear

Cruise ships to return to Baltimore two months after bridge collapse 

Rep. AOC's 'people-first' approach

Rep. Cori Bush: Activism is 'part of who I am'

Roy Lichtenstein’s pop-art take on Eve hides some deep theology

Trump

Big Tech news and how to take control of your data and devices

See more coverage in your recommendations

Technology

Tips delivered to your inbox twice weekly

The Tech Friend newsletter

Business and Tech alerts

Healthy living, including food, fitness, longevity and mental health

See alerts for Health and Wellness developments

Health & wellness

Tips on living better delivered every Thursday

Well+Being newsletter

Health alerts

Health & Science alerts

Joe Raedle

A <a href="https://www.washingtonpost.com/business/2021/05/12/ransomware-attack/" target="_blank" class="contextual_link">ransomware</a> gang once thought to have been crippled by law enforcement has snarled prescription processing for millions of Americans over the past week, forcing some to choose between paying prices hundreds or thousands of dollars above their usual insurance-adjusted rates or going without lifesaving medicine.

Insurance giant UnitedHealthcare Group said the hackers struck its Change Health business unit, which routes prescription claims from pharmacies to companies that determine whether patients are covered by insurance and what they should pay. The hackers stole data about patients, encrypted company files and demanded money to unlock them, prompting the company to shut down most of its network as it worked to recover.

Change Health and a rival, CoverMyMeds, are the two biggest players in the so-called switch business, charging pharmacies a small fee for funneling claims to insurers.

“When one of them goes down, obviously it’s a major problem,” said Patrick Berryman, a senior vice president at the National Community Pharmacists Association.

A notorious Russian-speaking ransomware ring known as ALPHV claimed responsibility for the Feb. 21 breach, capping a string of attacks that included several hospitals.

The lasting issues underscore the continued fragility of critical infrastructure nearly three years after a <a href="https://www.washingtonpost.com/business/2021/05/08/cyber-attack-colonial-pipeline/" target=_blank>ransomware attack on Colonial Pipeline</a> prompted a shutdown of the biggest network of fuel pipelines in the United States. Service stations, particularly in the eastern half of the country, ran short of fuel as consumers rushed to gas up.

Since then, U.S. officials and their international partners have announced a series of operations that have included hacking the gangs, taking over their chats with business associates and, in some cases, making arrests. ALPHV was targeted in a December takedown that proved short-lived.

FBI Deputy Assistant Director Brett Leatherman, who heads the agency’s cyber division, said Friday that it weighs multiple factors in deciding when to disrupt a group, including whether it will provide technical material that will aid victims, such as decryption keys.

“With ALPHV, part of why that was such a success is because of the way we helped the victims,” Leatherman said in an interview.

U.S. pharmacies reported a wide range of impacts, with independent stores experiencing some of the worst problems.

UnitedHealth estimated that more than 90 percent of the nation’s 70,000-plus pharmacies have had to alter how they process electronic claims as a result of the Change Health outage. But it said only a small number of patients have been unable to get their prescriptions at some price.

At CVS, which operates one of the largest pharmacy networks in the nation, a spokesperson said there are “a small number of cases in which our pharmacies are not able to process insurance claims” as a result of the outage. It said workarounds were allowing it to fill prescriptions, however.

Many pharmacies have started routing claims through CoverMyMeds, which posted a notice online Feb. 22, “No outages here.” The company, owned by McKesson, did not respond to a request for comment Thursday.

For pharmacies that were not able to quickly route claims to a different company, the Change Health outage left pharmacists to try to manually calculate a patient’s co-pay or offer them the cash price.

Compounding the impact, thousands of organizations cut off Change Health from their systems to ensure the hackers did not infect their networks as well.

UnitedHealth’s own pharmacy services company, Optum Rx, said it, too, disconnected but that it would not penalize pharmacies that made their best efforts to tell whether a given drug was covered for a patient. Optum said in a letter to those pharmacies that it was “committed to reimbursing all claims that are appropriate and filled with the good faith understanding that a medication should be covered.”

The attack on Change Health has left many pharmacies in a cash-flow bind, as they face bills from the companies that deliver the medication without knowing when they will be reimbursed by insurers.

Some pharmacies are requiring customers to pay full price for their prescriptions when they cannot tell if they are covered by insurance. In some cases, that means people are paying more than $1,000 out of pocket, according to social media posts.

The outage has also created havoc for patients who use drugmaker coupons to get their prescriptions at a discount. Some reported being told that the coupon system also relies on Change Health.

Amy Ginsburg, a Bethesda resident, said her local CVS wasn’t able to process a coupon she uses for her diabetes medication.

“Normally, it would be a $25 co-pay, but it will actually be a $250 co-pay,” she said. Ginsburg, 62, still has some medication left and plans to wait for the refill until next week, hoping the situation will be resolved by then.

“If I didn’t have sufficient quantity to tide me over, it could lead to serious consequences,” she said. “Not everyone has an extra $250 they weren’t expecting to spend.”

The situation has been “extremely disruptive,” said Erin Fox, associate chief pharmacy officer at University of Utah Health.

“At our system, our retail pharmacies were providing three-day gratis emergency supplies for patients who could not afford to pay the cash price,” Fox said by email. “In some cases, like for inhalers, we had to send product out at risk, not knowing if we will ever get paid, but we need to take care of the patients.”

Axis Pharmacy Northwest near Seattle is “going out on a limb and dispensing product with absolutely no inkling if we’ll get paid or not,” said Richard Molitor, the pharmacist in charge. “Probably the biggest impact has been with our hospice clientele, whose claims aren’t going through at all.”

The Change Health outage has been particularly tough on independent pharmacies, because they can only see prescriptions that a patient filled at their pharmacy — and not ones that the patient filled at others. The “switch” connects independent pharmacies to insurers or pharmacy-benefit managers, who have a more expansive view.

This means small pharmacies wouldn’t know if a drug they dispense interacts with another drug a patient received at a different pharmacy or whether a patient is trying to fill a controlled substance from multiple pharmacies.

“They’re flying blind when it relates to prescriptions filled at other pharmacies,” said Berryman, the National Community Pharmacists Association official.

ALPHV is one of the largest groups performing “ransomware as a service,” splitting extortion money with affiliates that do the actual hacking and then install ALPHV’s BlackCat ransomware encryption program. ALPHV then handles the threats and negotiations.

The group has collected more than $300 million this way, hitting such high-profile targets as <a href="https://www.washingtonpost.com/technology/2023/09/22/mgm-hack-laid-to-star-fraud/" target=_blank>Caesars Palace</a> in Las Vegas.

In December, the Justice Department said it and partner nations had <a href="https://www.washingtonpost.com/politics/2023/12/20/cybersecurity-202-government-operation-wounds-big-time-ransomware-gang/" target=_blank>hacked </a>ALPHV, recovering hundreds of decryption keys so that victims could get their data back without paying, and some analysts predicted the group would not recover from the internal penetration.

But as the past week has shown, ALPHV was hardly disabled. ALPHV reappeared on another site within days and announced it would exact revenge. It invited its affiliates to break into more sensitive American targets.

“These law enforcement-led disruptions are most effective when they are paired with an arrest or identifying information about individuals,” said Adam Meyers, senior vice president of intelligence at security company CrowdStrike.

Groups open to affiliates are especially resilient unless the trust among the criminals is broken, said Chris Krebs, former head of the U.S. Cybersecurity and Infrastructure Security Agency.

“If you want permanent, long-lasting impacts, it is going to require taking some of these guys off the playing field,” Krebs said. “But there’s more guys waiting in the wings.”

Top 10 nonfiction books of 2019, Hudson Booksellers

Top 10 nonfiction books of 2010, Hudson Booksellers

Book of the year finalist in 2003, Investigative Reporters & Editors 

Best in Business awards in 2017 and other years, Society for Advancing Business Editing and Writing

Gerald Loeb Awards finalist in 2017 and other years

Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World

Fatal System Error: The Hunt for the New Crime Lords who are Bringing Down the Internet

All the Rave: The Rise and Fall of Shawn Fanning's Napster

Harvard College, A.B. in English

Joseph Menn joined The Post in 2022 after two decades covering technology for Reuters, the Financial Times and the Los Angeles Times. His books include "Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World" (2019) and "Fatal System Error: The Hunt for the New Crime Lords who are Bringing Down the Internet" (2010). 

Joseph Menn

University of Chicago, BA in International Studies

Daniel Gilbert joined The Washington Post in 2022 and writes about the business of medicine. He previously spent seven years as an investigative reporter for the Seattle Times, and before that covered business and energy for the Wall Street Journal.

Daniel Gilbert

washpost

Ransomware hack hits prescription drug market, inconveniencing millions

the-washington-post

CVS Quarterly Earning Beat Expectations, But They're Lowering Outlook

Staff

Getty Images

Help Desk

Artificial Intelligence

Internet Culture

Space

Tech Policy

Tech

prism://prism.query/two-sites,/technology,/politics/powerpost/the-technology-202?limit=20

prism://prism.query/site,/technology/tech-policy&limit=20

prism://prism.query/site,/health&limit=20

Health

The Washington Post health section provides coverage and analysis of health, healthcare, nutrition and fitness news.

Well+Being

Well+Being from The Washington Post covers healthy living, including nutrition, fitness, mental health, relationships, chronic illness and disability.