Research Library
Change Healthcare Ransomware Attack 2024
On 21 February 2024, ransomware hit Change Healthcare, the US healthcare payments processor that handles a large share of the country's medical claims. Pharmacies could not fill prescriptions, providers could not get paid, and the disruption lasted for weeks. This case study covers only confirmed facts, attributed and dated.
What happened, in brief
Change Healthcare is a subsidiary of UnitedHealth Group and one of the largest healthcare payment processors in the United States, processing roughly one in every three US medical claims and about 15 billion transactions a year, connecting more than 900 health-plan payers with over 1.6 million providers. On 21 February 2024, ransomware encrypted its systems. Within days, pharmacies could not adjudicate prescriptions, hospitals lost revenue-cycle visibility, and clinicians were forced back to paper-based workflows. The disruption rippled across the US healthcare system for weeks and, in some areas, for months.
Timeline of confirmed events
- 12 February 2024: attackers from the ALPHV/BlackCat ransomware operation log in to a Change Healthcare Citrix remote-access portal using compromised credentials. The portal has no multi-factor authentication.
- 21 February 2024: ransomware is deployed, encrypting Change Healthcare's systems and disrupting claims and pharmacy processing nationwide.
- February–March 2024: pharmacies struggle to fill prescriptions and providers cannot get paid; the American Hospital Association reports that more than 90% of hospitals experienced financial impacts. The US Department of Health and Human Services activates emergency relief, including accelerated Medicare payments.
- March 2024: UnitedHealth Group pays a reported $22 million ransom to ALPHV/BlackCat. The group's operators are reported to have kept the payment without sharing it with the affiliate who carried out the attack — described by researchers as an exit scam.
- May 2024: UnitedHealth Group CEO Andrew Witty testifies before Congress, confirming the Citrix entry point, the absence of multi-factor authentication, and the $22 million payment, and stating the company did not get its data back.
- 2024: a second extortion attempt is made against Change Healthcare, reported to involve a different group, RansomHub, using data still held by the original affiliate. The US Department of Health and Human Services Office for Civil Rights opens a formal HIPAA investigation.
- October 2024: UnitedHealth Group discloses the full scope: approximately 190 million individuals affected, revised from earlier estimates of around 100 million; the final notification figure reported later is about 192.7 million.
How the attackers got in
The entry point was not a sophisticated exploit. On 12 February 2024, attackers used compromised credentials to log in to a Citrix remote-access portal at Change Healthcare. The portal lacked multi-factor authentication. The attackers were inside the environment for about nine days before deploying the ransomware on 21 February. The absence of multi-factor authentication was confirmed by UnitedHealth Group CEO Andrew Witty in congressional testimony in May 2024, and it is the single most cited fact of the case: a portal that guarded access to the core of US healthcare payments was protected by a password alone.
A further detail from the company's own disclosures illustrates the scale of the data involved: the attackers are reported to have stolen over six terabytes of health and financial data. The exact contents of the stolen data were described in the company's notifications to individuals; this case study does not reproduce or enumerate individual records, and it publishes no leaked data of any kind.
Why it hit so hard
Change Healthcare is infrastructure, not a single hospital or insurer. It sits in the middle of US healthcare payments, and its failure cascaded: pharmacies could not verify coverage or process claims, hospitals could not bill, small practices reported cash-flow shortfalls exceeding $100,000 a week according to contemporary reporting, and the American Hospital Association reported that more than 90% of hospitals experienced financial impacts, with about 60% reporting significant revenue disruption. The Department of Health and Human Services activated accelerated Medicare payments — an extraordinary measure that reflects how systemic the impact of a single vendor's compromise had become.
The case is now the most cited example of third-party and supply-chain risk in healthcare: the breached organisation was not the hospital or the insurer, but the processor both depend on. Its lesson applies far beyond healthcare — any sector where one vendor carries a large share of an essential flow has the same exposure.
The ransom and the exit scam
UnitedHealth Group paid a reported $22 million ransom in bitcoin. What happened next is unusual even in ransomware cases: the ALPHV/BlackCat operators are reported to have kept the entire payment and never paid the affiliate who carried out the breach its promised share. Security researcher Fabian Wosar of Emsisoft described it as a textbook exit scam. The scammed affiliate still held the stolen data and used it to launch a second extortion attempt against Change Healthcare through a different group, reported to be RansomHub. The company's CEO testified that, despite paying, the company still did not get its data back.
The total financial impact reported by UnitedHealth Group for 2024 was about $3.09 billion, covering operational disruption, remediation, provider support and ongoing legal exposure, including the ransom payment. Related reporting cites a figure of about $2.87 billion for operational and reputational losses on a different basis; the $3.09 billion figure used here is the company's own reported total for 2024, and the difference is a matter of what is counted.
Attribution: what is confirmed
The attack was carried out by an affiliate of ALPHV, also known as BlackCat, a ransomware-as-a-service operation active from late 2021 into 2024. That attribution rests on UnitedHealth Group's own disclosures and the CEO's congressional testimony, and on the FBI's earlier seizure of parts of the ALPHV infrastructure in December 2023. The operation collapsed in 2024 after the Change Healthcare ransom, with the operators disappearing in what researchers described as an exit scam against their own affiliates. Former affiliates have continued operating under other groups, according to public reporting; no claim about any individual attacker is made here beyond the public record.
What changed afterwards
The US Department of Health and Human Services Office for Civil Rights opened a formal HIPAA investigation into Change Healthcare and UnitedHealth Group, focused on whether protected health information was breached and whether HIPAA rules were complied with — described at the time as the largest breach of healthcare data in American history. The case is now the standard example in healthcare cybersecurity training and in US policy discussion of mandatory minimum controls: multi-factor authentication on all remote access, with no exceptions for legacy portals, is the first line, and it is the control whose absence caused this breach.
For the defensive concepts behind this case, see our guides to SOC analysis and CVE and patching.
Sources
- UnitedHealth Group — disclosures and CEO congressional testimony, May 2024 (entry point, MFA absence, $22 million ransom)
- US Department of Health and Human Services — breach notification and OCR investigation (approximately 190 million individuals)
- CSO Online — economics of ransomware, Change Healthcare $3.09 billion impact
- Illumio — BlackCat (ALPHV) ransomware background and collapse
Frequently asked questions
What happened in the Change Healthcare attack?
On 21 February 2024, ransomware from the ALPHV/BlackCat operation encrypted Change Healthcare's systems, disrupting claims and pharmacy processing across the United States for weeks. Attackers had entered nine days earlier through a Citrix remote-access portal using compromised credentials, with no multi-factor authentication.
How many people were affected?
UnitedHealth Group, the parent company, notified the US Department of Health and Human Services that approximately 190 million individuals were affected — revised upward from an initial estimate of around 100 million. Later reporting put the figure at about 192.7 million in the final notification.
Who was behind the Change Healthcare attack?
The attack was carried out by an affiliate of the ALPHV/BlackCat ransomware-as-a-service operation, as confirmed in UnitedHealth Group's disclosures and in the CEO's congressional testimony in May 2024.
Did Change Healthcare pay the ransom?
UnitedHealth Group confirmed it paid a ransom of $22 million. The company's CEO testified that the company still did not get its data back, and a second extortion attempt followed from a different group.
How did the attackers get in?
Through a Citrix remote-access portal, using compromised credentials. The portal lacked multi-factor authentication — a fact confirmed by UnitedHealth Group CEO Andrew Witty in congressional testimony in May 2024.
What was the total cost?
UnitedHealth Group's year-end reporting put the total financial impact for 2024 at about $3.09 billion, including the ransom, operational disruption, remediation and provider support. Figures for total cost vary by source and by what is counted; this figure is the company's own reported total.