{"id":6803,"date":"2024-09-18T09:50:24","date_gmt":"2024-09-18T13:50:24","guid":{"rendered":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/?p=6803"},"modified":"2024-10-24T12:32:05","modified_gmt":"2024-10-24T16:32:05","slug":"five-backup-lessons-learned-from-the-unitedhealth-ransomware-attack","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/five-backup-lessons-learned-from-the-unitedhealth-ransomware-attack\/","title":{"rendered":"Five Backup Lessons Learned – From The UnitedHealth Ransomware Attack"},"content":{"rendered":"

\"\"<\/p>\n

Continuity’s Doron Youngerwood offers insights on backup lessons learned from the UnitedHealth ransomware attack. <\/strong><\/em>This article originally appeared on Solutions Review’s Insight Jam<\/a>, an enterprise IT community enabling the human conversation on AI.<\/strong><\/em><\/p>\n

UnitedHealth Congressional Testimony Reveals Failed Backup Strategy<\/strong><\/h4>\n

The ransomware attack on UnitedHealth earlier this year is quickly becoming the healthcare industry\u2019s version of\u00a0Colonial Pipeline<\/a>, prompting congressional testimony, lawmaker scrutiny, and potential legislation.<\/p>\n

Over the past few months, there have been two congressional hearings on the attack \u2014 one in the\u00a0Senate<\/a>, followed by one in the\u00a0House<\/a>\u00a0\u2014 as well as calls from multiple senators for investigations into how the government responded to the incident, not to mention the criticism against UnitedHealth\u2019s CISO, Steven Martin, who joined the company in June 2023.<\/p>\n

After paying a\u00a0ransom of $22 million<\/a>\u00a0to prevent the leak of stolen data, UnitedHealth had to perform a complete rebuild on its systems, even after decrypting files.<\/p>\n

In his\u00a0testimony<\/a>, UnitedHealth’s CEO Andrew Witty identified that\u00a0the company\u2019s backups weren’t sequestered with network segmentation or infrastructure gapping<\/strong><\/a>, so the attackers were able to lock those up too, blocking any recovery path from the initial attack.<\/p>\n

Backups \u2013 A Cybercriminals Most Lucrative Target<\/strong><\/h3>\n

Very few CISOs used to pay much attention to their backups. That\u2019s no longer the case today.<\/p>\n

Ransomware has pushed backup and\u00a0recovery\u00a0back onto the IT and corporate agenda \u2013 even before the attack on UnitedHealth earlier this year.<\/p>\n

Attackers realize that a successful breach of a backup environment is the single biggest determining factor if an organization will pay the ransom.<\/p>\n

Some\u00a0#ransomware<\/a> groups \u2013 BlackCat, Akira, Lockbit, Phobos, and Crypto, for example \u2013 have been bypassing production systems altogether and going straight for the backups.<\/p>\n

This has forced organizations to look again at potential holes in their safety nets by reviewing their backup and data recovery strategies.<\/p>\n

<\/a><\/p>\n

So, how should IT Infrastructure and Security teams deal with this threat?\u00a0<\/strong><\/h4>\n

5 Tips To Secure Your Backups<\/strong><\/h3>\n