Hello. Eight months after a ransomware attack that has so far cost UnitedHealth Group more than $2.4 billion, the insurer has replaced its chief information security officer.

Tim McKnight has joined UnitedHealth as CISO, the longtime cyber leader said Tuesday in a LinkedIn post.

He replaces Steven Martin, who has shifted to chief restoration officer, a new role at UnitedHealth, a company spokesman said.

More on this leadership change below.

Also today:  

• Suspected China-sponsored hackers targeted Trump family
• Third-party hacks lead to more data breaches
• Cyber outsource to grow

Cybersecurity outsourcing is expected to jump nearly 16% to $86.1 billion in the coming year, according to tech research company Gartner. Companies with hiring freezes or difficulties finding the right staff are farming out threat detection and security training, among other tasks, says market researcher IDC. (CSO Online)

Eighteen months after being hacked, Greylock McKinnon Associates is notifying 13,549 customers of a client that their data was compromised. Greylock, an economic and legal consulting firm, spotted unusual activity on its network in May 2023. Ten months later, in March 2024, the Boston-based company determined that information was exposed. Greylock started to send letters to consumers on Tuesday. A notice sent to state regulators didn’t say what type of data was accessed or viewed.

• In another third-party breach, SysInformation Healthcare Services is notifying clients’ customers their is at risk after a network intrusion over 15 days in June 2023. SysInformation, which provides healthcare billing services under the name EqualizeRCM, didn’t disclose how many individuals were affected.

Tim McKnight arrives at UnitedHealth as the company mails letters to at least 100 million U.S. residents informing them their personal, financial and medical details were compromised by ransomware attackers.

Recovery, lost revenue and other expenses are expected to hit $2.87 billion by the end of the year. UnitedHealth had no cyber insurance, faces several class-action lawsuits over the incident and is sorting out federal and state regulatory demands.

Meanwhile, it is unclear what Martin’s new position entails. The UnitedHealth spokesman declined to provide details and Martin didn’t respond to a request for comment.

On LinkedIn, he said, “I’ll continue working with industry partners across the healthcare / technology ecosystem to ensure we’re building trust and transparency in our cybersecurity posture.” 

Martin was short lived as CISO—18 months—appointed in June 2023 after about four years of leading tech at two UnitedHealth business units.

Sen. Ron Wyden (D., Ore.) noted Martin hadn’t held a fulltime cybersecurity position before taking the corporate CISO job, in a letter in May to the Federal Trade Commission and the U.S. Securities and Exchange Commission. He urged the watchdogs to investigate UnitedHealth’s security practices.

McKnight brings three decades of security experience, gained at companies including enterprise software maker SAP, media giant Thomson Reuters, and conglomerate General Electric.

Most recently, in January, he had left the CISO profession to become an operating partner at venture capital firm SYN Ventures, advising on cybersecurity startups.

During a panel of former cyber chiefs at the RSA Conference in June, McKnight was asked whether he wanted to be a CISO again. He was cautious and discussed conditions.

“Dare I say yes,” he said, “with the appropriate controls in place and the right practices … to protect yourself from liability.”

He continued: “I think that CISOs have the right to make some demands in their role, to have certain authorities that are very clear to do what they need to do,” he said. “There’s really no other role in the company—maybe the CFO—that has as much exposure externally to the government, to marketing the products, to sharing with others in industry, to the SEC.”

—Kim S. Nash

The WSJ Pro Cybersecurity team is Deputy Editor Kim S. Nash (on X @knash99), reporter James Rundle and reporter Catherine Stupp (@catstupp). Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.