UnitedHealth Group has tallied up the costs from its Change Healthcare cyberattack including direct response, funding to care providers and lost revenue as the incident sucked out $3 billion of cash flow in the first quarter.
For 2024, UnitedHealth said the tab for the Change Healthcare cyberattack could be as high as $1.6 billion.
In February, UnitedHealth's Change Healthcare unit was hit with a ransomware attack. Since Change Healthcare processes claims and handles other financial processes prescriptions couldn't get filled and physicians ran low on cash.
On March 27, UnitedHealth said Change Healthcare could process medical claims, but its update page notes that some payer processes are being restored through April. The company also said it has provided more than $6 billion in advance funding and interest-free loans to care providers.
Couched in non-GAAP results and pro forma noise, you have to scroll to the bottom of UnitedHealth's first quarter earnings release to get a feel for the Change Healthcare costs. Here's the breakdown:
- $1.22 billion: First quarter net loss for UnitedHealth, but some of that was due to the sale of a subsidiary.
- $279 million: Business disruption impacts to UnitedHealth's Optum unit, which houses Change Healthcare. Business disruption impacts refer to revenue lost during the cyberattack.
- $593 million: Total direct response costs due to the cyberattack. Costs attributed to the Optum unit were $363 million.
- $872 million: Total UnitedHealth costs related to the Change Healthcare attack.
- $1.35 billion to $1.6 billion: Total cyberattack hit for 2024 as projected by UnitedHealth, or $1.15 a share to $1.35 a share.
Adjusted for the Change Healthcare fiasco, UnitedHealth reported earnings of $6.91 per share on revenue of $99.8 billion. Both figures topped Wall Street estimates. UnitedHealth's adjusted figures included the revenue hit to Change Healthcare and excluded direct response costs.