Change Healthcare ransomware (ALPHV/BlackCat)

In February 2024, ALPHV/BlackCat operators compromised Change Healthcare, a UnitedHealth Group subsidiary that processes more than a third of U.S. health-claim transactions. The attackers entered through a Citrix remote-access portal that had no multi-factor authentication, used stolen credentials, and dwelled in the network for nine days before detonating their ransomware payload on 21 February 2024.

What happened

Change Healthcare took its systems offline immediately, but the operational blast radius was enormous: pharmacies across the United States could not verify insurance coverage, hospitals struggled to bill Medicare and private insurers, and small clinics ran out of cash. The disruption lasted weeks.

On 3 March 2024, blockchain analysts identified a bitcoin transfer of about 22 million USD to an ALPHV-affiliated wallet — widely interpreted as the ransom payment. ALPHV's operators then exit-scammed their own affiliate, who in turn leaked the stolen data and launched a second extortion attempt under the RansomHub brand.

Impact

• Estimated 100 million individuals had personal and health information stolen — the largest U.S. healthcare data breach on record.
• Total incident cost to UnitedHealth Group: over $2.87 billion.
• Pharmacies, hospitals, and federal Medicare claims processing disrupted for weeks; HHS made emergency advance payments to providers.
• Triggered congressional hearings on healthcare cybersecurity and the resilience of consolidated payment infrastructure.

Why it matters

A single un-MFA'd remote-access portal at one billing intermediary brought a meaningful share of the U.S. healthcare system to a halt. The incident is now a reference case for third-party concentration risk in critical infrastructure — and for why MFA on every external-facing portal is not optional.