Amplix logo
Resources Insights What We Can Learn from the United Health Hack

What We Can Learn from the United Health Hack

On February 21, 2024, United Health announced a cyber incident at Change Healthcare linked to CVE-2024-1709  which is a critical vulnerability given the highest score on the Common Vulnerability  Scoring System.

The incident had far-reaching impacts into the healthcare system, grinding prescription fulfillment for millions across the country to a halt and potentially exposing patient data.

The vulnerability is associated with ConnectWise ScreenConnect 23.9.7 where a threat actor can bypass security to gain access. ConnectWise ScreenConnect 23.9.7 and prior are affected by an authentication bypass using an alternate path or channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

Ultimately, the company reportedly paid the hackers $22 million, though United has declined to comment directly on that. 

This incident highlights the reality that even the world’s largest organizations with seemingly limitless resources, using the best-of-breed enterprise software, can be vulnerable in unseen ways. Small and mid-sized companies are just as at risk, if not more. Some ways to protect yourself include:

  • Have a strong and strategic defensive posture
  • Have a remediation and continuity plan in place
    • Proactive monitoring, intrusion, and threat detection
    • Zero Trust environment
    • Rapid incident response capability
    • Continuous software update and patch implementation
  • Understand and mitigate the risks of partners and vendors in your supply chain ecosystem
  • Have backups of your critical data

If you’re a ConnectWise user, immediate action should be taken. Even if you’re not, Amplix’s security experts is on hand to help if you’re not sure where to start. It’s better to have the conversation now than after an incident occurs, so let’s talk!

Find out how Amplix can increase your Return on IT