The RansomHub cybercrime group has demanded a significant ransom from Change Healthcare after it claimed it stole 4 terabytes of information from the healthcare company’s systems in February.

In February, Change Healthcare, now part of Optum Solutions following a merger, said it experienced enterprise-wide connectivity issues due to which certain applications were not functioning. The company later said the outage occurred due to a “cyber security issue” and that operational disruption could last throughout the day.

Later, in another statement, Change said the impact of the cyber attack was restricted to its internal systems and all other systems across UnitedHealth Group, its parent company, were operational.

On February 28, the infamous ALPHV/BlackCat ransomware group claimed responsibility for the cyber attack on Change Healthcare and listed it as a victim on its data leak site. It was also reported that the Bitcoin address connected to the ransomware group received 350 bitcoins in a single transaction, or close to £18.3 million based on exchange rates at the time.

The UnitedHealth Group, however, did not comment on whether it paid a ransom to the Russian hacker group. “We are focused on the investigation and restoring operations at Change,” it said.

In a statement shared with the media, Andrew Witty, CEO of UnitedHealth Group, said, “We are committed to providing relief for people affected by this malicious attack on the U.S. health system.

“All of us at UnitedHealth Group feel a deep sense of responsibility for recovery and are working tirelessly to ensure that providers can care for their patients and run their practices, and that patients can get their medications. We’re determined to make this right as fast as possible,” he added.

Recently, a group of threat actors using the pseudonym RansomHub said that it is in possession of 4TB of data stolen from Change Healthcare. It said the stolen data includes personally identifiable information of active US military personnel and other patients, medical records, payment information, and more.

The group also claims to possess more than 3,000 source code files for Change Healthcare’s software solutions.

According to screenshots shared on X, the group has given Change Healthcare a deadline of 12 days to pay a ransom, failing which it has threatened to publish the stolen data.

“Change Healthcare and United Health you have one chance in protecting your clients data. The data has not been leaked anywhere and any decent threat intelligence would confirm that the data has not been shared nor posted.

“In the event you fail to reach a deal the data will be up for sale to the highest bidder here,” the group said. Change is yet to respond officially to the hacker group’s claims.