Change Healthcare is going through a brand new cybersecurity nightmare after a ransomware group started promoting what it claims is Americans’ delicate medical and monetary data stolen from the health care giant.

“For most US individuals out there doubting us, we probably have your personal data,” the RansomHub gang stated in an announcement seen by WIRED.

The stolen information allegedly contains medical and dental data, fee claims, insurance coverage particulars, and private data like Social Security numbers and electronic mail addresses, in accordance with screenshots. RansomHub claimed it had well being care information on active-duty US navy personnel.

The sprawling theft and sale of delicate well being care information represents a dramatic new type of fallout from the February cyberattack on Change Healthcare that crippled the corporate’s claims-payment operations and despatched the US well being care system into disaster as hospitals struggled to remain open with out common funding.

Change Healthcare, a subsidiary of UnitedHealth Group, beforehand acknowledged {that a} ransomware gang often known as BlackCat or AlphV breached its techniques, and advised WIRED final week that it’s investigating RansomHub’s claims about possessing the corporate’s stolen information. Change Healthcare didn’t instantly reply to a request for remark in regards to the group’s alleged sale of its information.

The huge number of affected person information that RansomHub claims to be promoting is a testomony to Change Healthcare’s function as a essential middleman between insurers and well being care suppliers, facilitating funds between each events and amassing reams of delicate details about sufferers and their medical procedures within the course of.

Among the pattern data that RansomHub posted are an inventory of open claims dealt with by the corporate’s EquiClaim subsidiary that features affected person and supplier names; a hospital document for a 74-year-old girl in Tampa, Florida; and a part of a database document associated to US navy service members’ well being care.

RansomHub stated it could enable particular person insurance coverage corporations that labored with Change Healthcare and had their information compromised to pay ransoms to forestall the sale of their data. It specified that it was promoting information belonging to a number of main insurance coverage corporations.

Change Healthcare’s “processing of sensitive data for all of these companies is just something unbelievable,” RansomHub stated in its announcement.

Brett Callow, a risk analyst on the safety agency Emsisoft who intently tracks ransomware gangs, says the brand new sale of stolen information was in all probability “less about actually selling the data” and extra about placing Change Healthcare—and the companion corporations whose data it failed to guard—“under additional pressure to pay.”

Change Healthcare appears to have paid a $22 million ransom to AlphV to cease it from leaking terabytes of stolen information.

Two months into the disaster spawned by the ransomware assault, Change Healthcare has confronted mounting losses. The firm not too long ago reported spending $872 million responding to the incident as of March 31.

At the identical time, Change is below rising stress from lawmakers and regulators to clarify its cybersecurity lapse and the steps it’s taking to forestall one other hack.

A subcommittee of the House Energy and Commerce Committee held a listening to on the well being sector’s cyber posture on Tuesday, with key lawmakers saying they have been disappointed that UnitedHealth Group declined to make an government accessible to testify. And the Department of Health and Human Services is investigating whether Change Healthcare’s failure to forestall hackers from accessing and stealing its information violated federal data-security guidelines.