The February 2024 Change Healthcare ransomware attack began with stolen credentials used on a Citrix remote-access portal that had no multi-factor authentication, and it ended as the largest reported health data breach in U.S. history, affecting roughly 192.7 million people. Change Healthcare is a claims clearinghouse — the intermediary that routes billing, eligibility checks and payments between providers, pharmacies and insurers — and it handles about a third of all U.S.
medical claims, which is why one login failure shut down cash flow at thousands of hospitals. This review walks the attack in order: the entry point and the nine days attackers spent inside before encryption, the extortion sequence and the $22 million bitcoin payment that did not stop it, the operational and financial damage, and the specific controls that would have changed the outcome. Every figure here comes from sworn testimony, federal advisories, HHS filings or UnitedHealth's own SEC disclosures.
Table of Contents
- The entry point: one portal, no second factor
- Who attacked, and why healthcare was the target
- Paying the ransom did not end the extortion
- What the outage did to hospitals and to UnitedHealth's books
- How the victim count reached 192.7 million, and why it may be high
- The controls that would have mattered, and the rule that may mandate them
- Frequently Asked Questions
The entry point: one portal, no second factor
UnitedHealth Group CEO Andrew Witty told the Senate Finance Committee that attackers used compromised credentials on February 12, 2024 to log into a Change Healthcare Citrix portal that did not have multi-factor authentication enabled. Citrix in this context is remote-desktop infrastructure — a gateway that gives staff access to internal applications from outside the corporate network. With a valid username and password and no second factor, the login looked legitimate. The gap between initial access and ransomware was nine days.
According to Witty's May 1, 2024 testimony, the intruders moved laterally through the environment and exfiltrated data across that window before deploying ransomware on February 21. That sequencing matters: the data was already gone when the encryption started, so restoring from backups could never have prevented the breach half of the incident. The nine-day dwell time is the more damning detail for defenders. An unprotected remote portal is a single missing control, but nine days of lateral movement and bulk data transfer without detection points to gaps in network segmentation, east-west traffic monitoring and data-loss detection as well.
Who attacked, and why healthcare was the target
UnitedHealth disclosed the attack on February 21, 2024, and the Russia-linked BlackCat/ALPHV group claimed it. BlackCat operated as ransomware-as-a-service: the core group builds and maintains the malware, and affiliates rent it, break into victims themselves, and split the proceeds. That structure means the "group" behind an attack is often two separate parties with separate incentives. Healthcare was not incidental.
CISA, the FBI and HHS updated their #StopRansomware: ALPHV Blackcat advisory on February 27, 2024 with new indicators and tactics, noting that healthcare had become the most-victimized sector among nearly 70 leaked victims since mid-December 2023 — a shift that followed the group urging its affiliates to hit hospitals directly. The Congressional Research Service's insight on the incident frames the systemic problem plainly: the target was not one hospital but the clearinghouse that roughly a third of U.S. medical claims pass through. Concentration in healthcare payment infrastructure turned a single-company intrusion into a national payment outage.
Paying the ransom did not end the extortion
Witty confirmed that the company paid roughly $22 million in bitcoin, sent March 3, 2024, in an attempt to protect patient data. The payment bought nothing durable. In April 2024, a second group, RansomHub, claimed a fresh extortion round with 4 TB of stolen data, after reporting indicated ALPHV's operators had run an exit scam on the affiliate who carried out the intrusion. This is the practical lesson for any organization weighing a payment.
In an affiliate model, paying the core operator does not bind the affiliate who actually holds the files. If the operator keeps the money and disappears, the affiliate still has the data and every reason to sell or re-extort it. There is a forensic footnote that compounds the problem. Change Healthcare learned of the data theft on March 7 and did not obtain a safe copy of the stolen data for analysis until March 13 — meaning the payment on March 3 preceded the company's own understanding of what had been taken.
What the outage did to hospitals and to UnitedHealth's books
The clinical and financial damage landed within weeks. An American Hospital Association survey of about 1,000 hospitals, conducted March 9–12, 2024, found: Those numbers come from the AHA's March 15, 2024 survey results. The patient-care figure is the one that separates this from an ordinary IT outage: when eligibility checks and prior-authorization routing stop, treatment decisions stall too.
UnitedHealth's own costs were larger than the ransom by two orders of magnitude. Its FY2024 Form 10-K reported $2.2 billion in direct cyberattack response costs plus $867 million in Optum Insight business-disruption impact, alongside roughly $9 billion in interest-free loans advanced to providers through September 30, 2024. Against that, a $22 million ransom was a rounding error — and MFA on the Citrix portal would have cost less still.
- 94% reporting a financial impact
- 74% reporting disruption to direct patient care
- Nearly 60% of cash-flow-affected hospitals losing $1 million or more per day
How the victim count reached 192.7 million, and why it may be high
The affected-individual total rose in stages as forensics progressed: 100 million notices in October 2024, 130 million in January 2025, and approximately 192.7 million reported to HHS on July 31, 2025. The HHS Office for Civil Rights incident FAQ documents the progression and the final figure. That figure carries a real limitation, and OCR states it. Change Healthcare could not fully deduplicate individuals across records because of name-spelling variations, so the same person may be counted more than once.
Treat 192.7 million as an upper-bound estimate of distinct people rather than a precise headcount — though even a heavily deduplicated version would remain the largest reported U.S. health data breach. Regulatory scrutiny started far earlier than the final count. OCR Director Melanie Fontes Rainer opened a HIPAA investigation of Change Healthcare and UnitedHealth Group in a March 13, 2024 "Dear Colleague" letter, citing the unprecedented magnitude of the attack.
The controls that would have mattered, and the rule that may mandate them
The specific failure here was an "addressable" safeguard treated as optional. Under the current HIPAA Security Rule, some controls are required and others are addressable — meaning an organization may implement an alternative or document why the control is not reasonable for its environment. MFA has lived in that second category.
The HIPAA Security Rule notice of proposed rulemaking published January 6, 2025 would change that. It would make multi-factor authentication and encryption of electronic protected health information explicitly mandatory and eliminate the addressable category entirely — closing the exact gap exploited at Change Healthcare. It remains a proposal, not enforceable law, so covered entities cannot yet be penalized under it. For a provider or vendor reading this as a checklist, the incident argues for four concrete moves:.
- Enumerate every externally reachable remote-access entry point — VPN, Citrix, RDP gateway, vendor portal — and confirm MFA on each, by testing a login rather than reading a config
- Treat dwell time as a separate metric from recovery time; nine days of undetected lateral movement is a detection failure, not a backup failure
- Assume a ransom payment does not retire the data risk, and plan notification and credit-monitoring obligations as if the files will be published
- Map which single vendors sit between you and your revenue, and know your manual fallback for claims, eligibility and prior authorization before you need it
Frequently Asked Questions
Did the ransom payment prevent the stolen data from being leaked?
No. RansomHub claimed a second extortion round in April 2024 with 4 TB of data, roughly a month after the $22 million payment was sent on March 3, 2024.
How long were attackers inside before anyone noticed?
They logged in on February 12, 2024 and ransomware was deployed on February 21 — nine days of lateral movement and data exfiltration, per Witty's Senate testimony.
Is 192.7 million the number of distinct people affected?
It is the number reported to HHS, but OCR notes Change Healthcare could not fully deduplicate individuals because of name-spelling variations, so the true count of distinct people is likely lower.
Does HIPAA currently require multi-factor authentication?
Not explicitly. The January 6, 2025 proposed Security Rule would make MFA and ePHI encryption mandatory and remove the "addressable" safeguard category, but it is still a proposal.
You Might Also Like
- Cybersecurity — Patient Data Exposed Security Review: Entry Point, Impact, and Lessons
- Cybersecurity — HIPAA Breach Security Review: Entry Point, Impact, and Lessons
- Cybersecurity — Crypto Scam Security Review: Entry Point, Impact, and Lessons