The U.S. Department of State is offering up to $10 million for information that identifies or locates anyone associated with the ALPHV/BlackCat ransomware gang. The offer, announced in a Wednesday statement, covers “their affiliates, activities, or links to a foreign government.”
That last phrase matters. The State Department implied BlackCat may be “acting at the direction or under the control of a foreign government,” such as Russia, where the gang is based. Security researchers have not yet found a connection between the group and any government.
BlackCat runs ransomware as a service. It recruits affiliates, effectively contractors who earn a commission for launching attacks, and keeps a cut of every ransom a victim pays. The State Department blamed the group for hitting U.S. critical infrastructure, including healthcare.
Change Healthcare
The reward widens an earlier one for the gang’s leadership so that it also covers affiliates. The timing follows the previous month, when an affiliate group claimed responsibility for the attack on Change Healthcare, a U.S. health tech company that processes around one in three U.S. patient medical records.
The attack knocked out much of the healthcare system’s access to patient records and billing information. For weeks, prescriptions went unfilled and surgical authorizations were delayed.
The affiliate went public with a grievance. It accused the main BlackCat gang of keeping $22 million in ransom that Change Healthcare allegedly paid to head off a mass leak of patient records. It called this an “exit scam,” in which hackers run off with the money and leave their affiliates unpaid. The affiliate said it still holds a large amount of stolen sensitive patient data.
Change Healthcare has said it ejected the hackers from its network and restored much of its systems. Its parent, UnitedHealth Group, has not yet confirmed whether any patient data was stolen.
