2024RansomwareData breach
Change Healthcare ransomware attack
February 2024
Attackers used stolen credentials to log in to a Change Healthcare remote access portal on 12 February 2024 and deployed ransomware nine days later, according to written testimony by UnitedHealth Group's CEO to the US House. The outage disrupted claims processing and payments across the US healthcare system for weeks.
- Victim
- Change Healthcare, part of UnitedHealth Group
- Sector
- Healthcare
- Public attribution
- ALPHV/BlackCat ransomware was reported as used in the attack.ALPHV / BlackCat profile
- Malware
- BlackCat (ALPHV)
Impact
UnitedHealth Group estimated in January 2025 that about 190 million people were affected, as reported by The Record; the company's CEO testified that he decided to pay a ransom.
Root cause
A remote access portal that did not have multi-factor authentication, according to the CEO's testimony.
Lessons learned: the controls it teaches
- Enforce MFA on every external access point, and audit regularly for gaps.
- Map concentration risk: one provider's outage can halt a whole sector.
- Integrate acquired companies' security controls quickly.