UnitedHealth, insurers called to act following Change Healthcare hack

Attackers leveraged the cross-platform app development framework Flutter to create the Minesweeper-emulating "New Updates in Crypto Exchange" app, which when executed prompts a Dart-based primary payload to facilitate AppleScript code execution, according to a report from Jamf Threat Labs.

Included in the data exfiltrated from Thompson Coburn's systems were individuals' names, birthdates, Social Security numbers, medical record and patient account numbers, treatment or prescription details, clinical information, medical provider details, and health insurance information, said the law firm in a disclosure to the Department of Health and Human Services.

Infiltration of Forth's systems resulted in the compromise of names, birthdates, Social Security numbers, and addresses, said the firm in its filing with the Office of the Maine Attorney General, which also noted its immediate action to remediate the incident.