Latest / Boardroom Conversations with Fexingo: CEOs, Strategy, and Corporate Leadership Explained / How the UnitedHealth Board Missed the Cyber Crisis
Transcript
- Lucas: So I want to start with a number: one point six billion dollars. That's what the ransomware attack on UnitedHealth's subsidiary Change Healthcare ended up costing the company in direct expenses. But that number almost misses the real story. Luna: Because the real story is that the board probably could have seen it coming? Lucas: Exactly. The attack hit in February 2024, and it froze a huge chunk of the US healthcare payments system. Pharmacies couldn't process prescriptions. Hospitals couldn't submit claims. And when the dust settled, the question wasn't just about IT security — it was about governance. How did a board with that much collective experience miss a threat that had been flagged for years? Luna: Let's start with the composition. What did UnitedHealth's board actually look like before the breach? Lucas: As of early 2024, the board had twelve directors. Strong credentials — former CEOs, investment bankers, a retired four-star general, an academic. But zero directors with deep cybersecurity experience. Not one had served as a chief information security officer or led a significant security transformation. Luna: That's actually pretty common for large-cap boards, isn't it? Most don't have dedicated cyber expertise. Lucas: It is common. And that's exactly the problem. A McKinsey survey from 2023 found that only 22 percent of S&P 500 boards had a director with a cybersecurity background. But the stakes are different when you're the largest healthcare company in America processing over 15 billion transactions a year. UnitedHealth's board was informed about cyber risk through quarterly risk reports, but those reports buried cybersecurity under 'operational risk' — a catch-all category. Luna: So it was visible on the agenda, but not as a standalone priority. Lucas: Right. And the warning signs were specific. In 2021, the Cybersecurity and Infrastructure Security Agency — CISA — issued an alert about ransomware threats to the healthcare sector. They pointed to the same kind of vulnerability that Change Healthcare eventually got hit on: third-party payment systems with broad network access. Luna: Did the board discuss that CISA alert specifically? Lucas: We don't know for sure, because the only records are board minutes from the subsequent shareholder lawsuits. But what we do know is that in early 2023, UnitedHealth's own internal audit flagged Change Healthcare's network segmentation as 'below industry standard.' The remediation plan was scheduled for late 2024. Luna: They scheduled the fix a year out, and the attack hit seven months early. Lucas: That's the kind of detail that surfaces in depositions. And it points to a governance failure that isn't about bad people — it's about a board that wasn't structured to ask the right questions. When the full board meets four times a year, and cyber is one item among fifteen on a packed agenda, the natural tendency is to assume management has it handled. Luna: And management — UnitedHealth's executive team — certainly had strong operational credentials. But the CEO at the time, Andrew Witty, came from a pharmaceutical background. The CIO had been in role only two years. Lucas: Which brings us to a broader point: boards tend to over-index on financial and operational expertise because those are the metrics that have historically mattered. Cyber is newer. It's technical. And directors often feel unqualified to challenge the CIO on technical specifics. So they don't. Luna: But the consequences here were massive — not just financially, but operationally. Change Healthcare processes one in every three patient records in the US. The outage lasted weeks. Lucas: And that's what makes this a board story rather than just an IT story. The board's job is to oversee the company's most significant risks. If cyber risk can knock out a critical subsidiary for weeks and cost over a billion dollars, then it's a board-level risk. Period. Luna: So what did UnitedHealth's board actually do after the breach? Lucas: A few things worth noting. First, they created a dedicated cybersecurity committee separate from the audit committee. Second, they added a new independent director in late 2024 — a former deputy director of the National Security Agency. And third, they changed the compensation structure for senior executives to include a cybersecurity metric tied to response time and recovery benchmarks. Luna: That compensation change is interesting — it signals that cyber is now seen as a leadership accountability issue, not just a tech issue. Lucas: Exactly. If you want executives to take cyber seriously, link their bonuses to it. But here's the thing: these reforms came after the fact. And the question for other boards is whether they need to wait for their own one-point-six-billion-dollar event to act. Luna: It's a tough question. And I imagine a lot of listeners in leadership roles are thinking about whether their own board has the right expertise. Lucas: Yeah, and since we're pulling back the curtain a little on how we think about these topics — if these conversations have moved your thinking forward in some small way, we should mention that a handful of listeners chip in monthly through Buy Me a Coffee dot com slash fexingo. That's literally what funds making this many episodes. No ads, just listener support from people who find this kind of governance analysis useful. Luna: It's a small group, but it's what keeps this ad-free and independent. So genuinely, thank you to those who do. Lucas: Anyway, back to UnitedHealth. One more thing I want to pull out: post-incident, the board commissioned an external review of its risk oversight process. The review found that the board's risk register had rated cyber as 'high likelihood, high impact' — but had not specified any concrete mitigation steps for the board to track. Luna: So they identified the risk correctly, but didn't operationalize the oversight. Lucas: That's the governance gap in a nutshell. A risk register isn't a plan. And a board that reviews a risk register once a quarter without drilling into specific controls is basically just hoping nothing bad happens. That's not oversight — that's optimism. Luna: What's the counterargument? Some would say that boards can't be experts in everything, and that's why they hire management teams. Lucas: Fair point. But the counter-counterargument is: if you can't evaluate the expertise on cyber, how do you know management is doing a good job? You don't need your board to be ciso level experts. But you do need at least one director who can tell the difference between a robust security posture and a PowerPoint slide full of buzzwords. Luna: And that's the lesson that's slowly spreading. The SEC actually updated its cyber disclosure rules in 2023, requiring boards to describe their role in cyber oversight. That forced more companies to put this on paper. Lucas: Right. And the data shows it's moving. According to a 2025 report from the National Association of Corporate Directors, about 38 percent of S&P 500 boards now have at least one director with formal cybersecurity credentials — up from 22 percent in 2023. So the needle is shifting, but it's still a minority. Luna: And UnitedHealth, to its credit, is now one of those boards. But the lesson is that composition matters before the breach, not after. Lucas: Exactly. And I think the biggest takeaway for any listener who serves on a board — or works with a board — is this: if your board hasn't held a standalone session on cyber risk in the last twelve months, you are operating on hope. And hope is not a risk management strategy. Luna: Any final thought on what boards should actually change tomorrow? Lucas: Two concrete things. First, add a 'cyber fluency' requirement to your director qualifications, even if you don't have a dedicated expert yet. Make sure every director understands the basics: what is a ransomware attack, what is supply chain risk, what is the incident response plan. Second, schedule an annual deep-dive session with the CISO — not the CIO, the CISO — where the board can ask questions without management present. That alone changes the dynamic. Luna: It forces the conversation to be real. Lucas: It does. And it turns board oversight from a check the box activity into an actual defense.