| schema:text
| - Days after the murder of UnitedHealthCare CEO Brian Thompson, a rumor circulated that his death may have benefitted Democrats. Thompson, the rumor said, had been poised to testify in a case of insider trading brought against U.S. Rep. Nancy Pelosi, a Democrat from California who long held the post of speaker of the House of Representatives and was still a top power broker in the party.
For example, a post appeared on X two days after Thompson's death, on Dec. 6, 2024 (archived):
(X/@realTrentLeisy)
As of this writing, the post had gained 561,000 views and 9,700 likes. The same claim appeared on X and on Instagram. But the rumor started immediately after Thompson's killing. For example, the evening of Dec. 4, 2024, an X account elaborated with some alleged details (archived):
Another post on X suggested the same thing, without providing as many details. This post had been viewed 2 million times. The same account later posted a video that claimed Pelosi used "MKUltra" [sic] — a now-defunct CIA program that studied mind-control drugs — to "put out a hit" on Thompson because he supposedly was about to testify against her in a case of insider trading that involved Palo Alto Networks, a cybersecurity firm hired to investigate a cyberattack that targeted Change Healthcare, another unit of UnitedHealth Group. Pelosi had allegedly invested in Palo Alto Networks on the day the cyberattack was revealed in February 2024.
As we will see, however, the claim had no basis in reality. We therefore rated it unfounded.
The Cyberattack and the Hiring of Palo Alto Networks
On Feb. 21, 2024, Change Healthcare, a subsidiary of UnitedHealth Group, detected a ransomware attack by the AlphV/BlackCat gang that instantly impacted healthcare providers' and pharmacies' ability to file claims and receive hundreds of millions of dollars in payments from the health insurer. The attack sparked outcry from politicians, including President Joe Biden. The American Hospital Association deemed it "the most significant and consequential incident of its kind against the U.S. health care system in history."
In response to the attack, Change Healthcare hired two cybersecurity firms to investigate. On Feb. 26, the company told The Register it had hired Mandiant and Palo Alto Networks to investigate the breach and remedy it:
Since identifying the cyber incident, we have worked closely with customers and clients to ensure people have access to the medications and the care they need. We also continue to work closely with law enforcement and a number of third parties, including Mandiant and Palo Alto Networks, on this attack against Change Healthcare's systems.
As the guarantor of privacy in healthcare, the U.S. federal government also launched an independent probe. In a letter dated March 13, 2024, the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) announced it was opening an investigation into the attack. However, a spokesperson for HHS OCR said that "OCR conducts its own investigations," indicating that OCR did not hire Palo Alto Networks for the probe. This shows that no elected official in Pelosi's position would have had any influence on such a contract with a cybersecurity firm.
Thompson Was Accused of Insider Trading, Not Pelosi
To back their claims, the X users relied on trading data that showed, accurately, Pelosi had bought call options on Palo Alto Networks stock. However they did not explain call options or how they work. A close look at the details of the trade revealed that Pelosi would have needed the cybersecurity firm's stock to fall, not rise, to execute that trade and benefit from it.
When customers buy a call option on a stock, they are not buying the stock outright. Instead, they are buying the right to buy the stock at a certain price — known as the "strike price" — within a certain time frame.
Searching Capitol Trades — a database that compiles all of the trades made by elected officials — we found that indeed two call option trades on Palo Alto Networks appeared under Pelosi's profile. The owner of those call options was her husband, Paul Pelosi. The dates of the trades contradicted the claims of rumormongers, as both trades occurred before the Feb. 21, 2024, cyberattack: the first on Feb. 11 for 50 call options and the second on Feb. 20 for 20 call options.
Further, Capitol Trades indicated that all call options would expire on Jan. 17, 2025, and that the "strike price" was $200. A historical chart of the stock's price showed that year-to-date, it had reached its lowest point on Feb. 21, at $260.09. On that day, it recorded the steepest intra-day drop in its history after the company forecast a cut in its billings after trading hours the day before. Later, the stock recovered. As of this writing, the cybersecurity's stock price was $395.41, nearly twice the call options' "strike price." In sum, as of a bit more than one month before the call options expire, the Pelosis have not been able to execute that trade.
There is indeed an ongoing case of insider trading involving Thompson, but it targets him, not Pelosi. In a lawsuit filed in a district court in Minnesota, the plaintiffs, which included the City of Hollywood Firefighters' Pension Fund in Florida, have accused Thompson and other executives of UnitedHealth Group of selling their shares of the company after they found out the U.S. Department of Justice had re-launched an antitrust probe into UnitedHealth Group, but before this investigation was made public:
UnitedHealth was aware of the DOJ investigation since at least October 2023. Instead of disclosing this material investigation to investors or the public, UnitedHealth insiders sold more than $120 million of their personally held UnitedHealth shares. In the four months between learning about the DOJ investigation and the investigation becoming public, UnitedHealth's Chairman Stephen Hemsley sold over $102 million of his personally held UnitedHealth shares and Brian Thompson, the CEO of UnitedHealthcare, sold over $15 million of his personally held UnitedHealth shares.
|
![[RDF Data]](/fct/images/sw-rdf-blue.png)
![[cxml]](/fct/images/cxml_doc.png)
![[csv]](/fct/images/csv_doc.png)
![[text]](/fct/images/ntriples_doc.png)
![[turtle]](/fct/images/n3turtle_doc.png)
![[ld+json]](/fct/images/jsonld_doc.png)
![[rdf+json]](/fct/images/json_doc.png)
![[rdf+xml]](/fct/images/xml_doc.png)
![[atom+xml]](/fct/images/atom_doc.png)
![[html]](/fct/images/html_doc.png)