Case study · 2024
Change Healthcare ransomware attack, 2024
A remote access portal without MFA led to the largest health data breach reported in the US.
Ransomware · missing MFA
What happened
- On 12 February 2024, criminals used compromised credentials to log in remotely to a Change Healthcare Citrix portal, according to testimony by UnitedHealth Group CEO Andrew Witty.
- On the morning of 21 February 2024, a group calling itself ALPHV or BlackCat deployed ransomware inside Change Healthcare’s IT environments. The company cut connectivity to its data centres to stop the spread.
- Change Healthcare processes a large share of US health insurance claims and pharmacy transactions, so providers and pharmacies across the country faced weeks of disruption to payments and prescriptions.
- In January 2025 UnitedHealth said about 190 million people were affected; the figure was later updated to about 192.7 million.
Root cause
The Citrix remote access portal used for the initial login did not have multi-factor authentication enabled, so a stolen username and password were enough to get in.
Control failures
- MFA was not enforced on an internet-facing remote access service.
- The attacker had days inside the network between initial access (12 February) and ransomware deployment (21 February).
- Heavy concentration: one provider sat in the critical path for a large share of the national healthcare payment system.
- Business continuity for customers depended on a single clearinghouse with no ready alternative.
Lessons for GRC
- Test, do not assume: verify MFA coverage on every remote access path, including acquired companies and legacy portals.
- Monitor for unusual activity after login (lateral movement, new admin accounts) to shorten attacker dwell time.
- Treat concentration risk in critical suppliers as a board-level risk, with tested workarounds.
- Integrate acquired businesses into the group’s security baseline quickly, with a tracked gap list.