Change Healthcare Cyberattack (2024)

Change Healthcare is one of the largest clinical and payments exchange platforms in the United States. It connects payers, providers, pharmacies, and patients across claim submission, eligibility verification, payment processing, electronic prescribing, and clinical data exchange. UnitedHealth Group acquired the company and integrated it into its Optum subsidiary in 2022.

By early 2024, Change Healthcare was processing roughly 15 billion healthcare transactions a year and touched, by UnitedHealth's own disclosures, around one in three US patient records. That concentration was the product of years of consolidation across the healthcare clearinghouse market. Hospitals, pharmacies, and insurers used it not because they all chose it, but because the ecosystem had standardized around it.

For most provider organizations, Change Healthcare was not a visible vendor relationship. It was a pipe behind a pipe. The clearinghouse that the practice management system used. The payments rail behind the pharmacy benefit manager. The eligibility check behind the front desk software. When the pipe broke, the entire ecosystem learned how dependent it had become.

Based on public disclosures from UnitedHealth Group, US Congressional testimony from CEO Andrew Witty, the US Department of Health and Human Services Office for Civil Rights, and reporting verified by reputable cybersecurity researchers, the timeline runs roughly as follows.

Initial intrusion. On 12 February 2024, the attackers logged into a Change Healthcare Citrix remote access portal using stolen credentials. The account did not have multi-factor authentication enabled.

Lateral movement and data exfiltration. Over the following nine days, the attackers moved laterally inside the environment, escalated privileges, and exfiltrated approximately six terabytes of data.

Ransomware detonation. On 21 February 2024, ALPHV/BlackCat deployed ransomware. Change Healthcare took systems offline. The public outage began the same day.

Public confirmation. On 22 to 23 February 2024, UnitedHealth confirmed a cybersecurity incident and the disruption to Change Healthcare services. Pharmacies, clinics, and hospitals across the United States began reporting their inability to process claims and prescriptions.

Reported ransom payment. In early March 2024, cryptocurrency researchers identified a 22 million US dollar Bitcoin payment to a wallet associated with ALPHV. UnitedHealth later confirmed under Congressional testimony that a ransom had been paid.

Second extortion. A second actor, publicly identifying as RansomHub, subsequently claimed to hold the stolen data and attempted a separate extortion, illustrating that paying the first ransom did not resolve the exposure.

Restoration. Key services were restored in phases over weeks and months. Smaller pharmacies and provider practices reported severe cash flow disruption during this period.

Regulatory and Congressional response. The US Department of Health and Human Services opened an Office for Civil Rights investigation. UnitedHealth Group CEO Andrew Witty testified before the US Senate Finance Committee and the House Energy and Commerce Committee in May 2024. UnitedHealth disclosed in its 2024 financial reporting that total breach- related costs exceeded 2.8 billion US dollars.

In plain English: the attackers logged in. They used a username and password on a Citrix portal that should never have been reachable with just a username and password. From there, they spent nine days quietly walking through a network that, by all public reporting, was still in the middle of being integrated after the Change Healthcare acquisition.

More technically, the publicly disclosed elements include:

• Credential-based access. Stolen credentials for a Citrix remote access portal. The account did not require MFA, which UnitedHealth's CEO confirmed in Senate testimony as the initial access path.
• Privilege escalation and lateral movement.Once inside, the attackers moved laterally and escalated privileges over roughly nine days before deploying ransomware. The specific tools were not fully disclosed publicly, but the pattern is consistent with ALPHV operations seen elsewhere: credential theft, hands-on-keyboard reconnaissance, and targeted exfiltration to attacker-controlled infrastructure.
• Data exfiltration. Approximately six terabytes of data, including protected health information, were exfiltrated before encryption.
• Ransomware detonation. ALPHV/BlackCat encryptors were deployed across critical Change Healthcare infrastructure, forcing the operational shutdown.
• Double and triple extortion dynamics. After the initial ransom, a second actor claimed the data and attempted further extortion, exposing a structural weakness in the assumption that paying ends the incident.

The technical control failures that mattered most:

• An internet-reachable remote access portal without MFA on a critical privileged account.
• Network segmentation that did not contain lateral movement from a single compromised entry point.
• Detection and response gaps that allowed nine days of hands-on-keyboard activity before ransomware execution.
• Backup and continuity architecture that, in practice, could not bring critical national payments and clinical exchange services back online for weeks.

No exploit code is included here. The defensive lesson is more useful than the offensive one.

Change Healthcare was not a third-party breach for one organization. It was a third-party breach for an entire industry, and it surfaced TPRM failures that had been quietly accumulating for years.

• Vendor concentration was treated as efficiency, not risk.Years of healthcare clearinghouse consolidation produced a single point of failure for a third of US medical claims. Almost no TPRM program had this concentration on a risk register at the right severity.
• Critical vendors of vendors were invisible.Most provider organizations had a relationship with their practice management system, their pharmacy benefit manager, or their EHR vendor, not with Change Healthcare directly. The clearinghouse was a fourth or fifth party for many of the organizations whose operations stopped.
• Operational resilience was not actually tested.Disaster recovery and business continuity plans existed on paper. Very few covered a multi-week outage of the payments and eligibility pipe, with no usable manual workaround.
• Post-acquisition integration risk was underestimated.UnitedHealth had acquired Change Healthcare and was still integrating environments and controls. The initial access path was, according to Senate testimony, an account that should not have been left without MFA.
• Notification and exposure mapping were slow.Affected covered entities and business associates struggled to determine which of their data had actually been taken, slowing breach notification to patients by months.
• Paying did not end the exposure. The second extortion attempt showed that the ransom payment did not guarantee data destruction, undermining a control many TPRM programs had implicitly relied on.
• Contractual notification SLAs did not match real impact.Standard contracts assumed a discrete data breach. The actual event was a continuous, weeks-long operational outage that standard SLAs were not written for.

The Change Healthcare incident is now one of the most expensive third-party cyber events in the history of any sector.

For UnitedHealth Group. The company disclosed in its 2024 financial reporting that breach-related costs exceeded 2.8 billion US dollars, covering response, restoration, advance funding to providers, notification, and remediation. The CEO testified before two Congressional committees. UnitedHealth's share price absorbed sustained scrutiny, and the company became the most prominent example of vendor concentration risk in US healthcare history.

For the broader ecosystem. Specific consequences included:

• Multi-week disruption to claims submission, eligibility verification, prior authorization, electronic prescribing, and payment processing across thousands of pharmacies, clinics, hospitals, and insurers.
• Severe cash flow stress for small provider practices, with UnitedHealth ultimately advancing billions of dollars in temporary funding.
• Disruption to prescription fulfilment, in some cases requiring manual intervention to dispense critical medications.
• Estimated exposure of protected health information on roughly one third of the US population, requiring one of the largest breach notification programs in HIPAA history.
• Sustained Congressional and regulatory scrutiny of vendor concentration in US healthcare infrastructure.
• Acceleration of multi-vendor clearinghouse strategies and renewed interest in interoperability and backup payment paths.

Change Healthcare reshaped how US regulators, healthcare boards, and TPRM teams think about systemic third-party risk.

• The US Department of Health and Human Services Office for Civil Rights opened an investigation and signaled increased scrutiny of business associate cybersecurity controls.
• HHS proposed substantial updates to the HIPAA Security Rule in late 2024, including stronger requirements for MFA, encryption, network segmentation, and incident response, explicitly citing recent healthcare incidents.
• Congressional hearings produced bipartisan calls for minimum cybersecurity standards in healthcare and for action on vendor concentration risk.
• State attorneys general opened parallel inquiries; class actions consolidated in US federal court.
• Industry groups began publishing playbooks for clearinghouse outages and multi-clearinghouse redundancy patterns.
• The ALPHV/BlackCat ransomware brand effectively collapsed following the incident, but the operators are widely understood to have rebranded and continued operating.

Some consequences are confirmed and measurable. Others, such as long-term changes in healthcare procurement, vendor concentration policy, and the legal standard for "reasonable" business associate cybersecurity, will keep unfolding through the second half of the decade.

1. Identify the vendors that are not on your direct vendor list but sit underneath your critical operational processes. Those are the ones that can stop you.
2. Score vendors on operational dependency, not just on data sensitivity. A vendor that processes nothing confidential but handles your payment rail is still tier one.
3. Map vendor concentration across your sector. If everyone depends on the same clearinghouse, broker, or rail, that is a board-level risk, not an IT risk.
4. Require MFA evidence, not MFA policy language, on every internet-reachable remote access path at every critical vendor.
5. Treat post-acquisition vendor environments as elevated risk until you can independently verify integration of security controls.
6. Define and rehearse multi-week vendor outage scenarios, not just data breach scenarios.
7. Stop treating ransom payment as a control that ends data exposure. Plan for second and third extortion attempts.
8. Pre-build manual fallbacks for payments, eligibility, and prescribing, even if the fallback is slower and uglier.
9. Define notification SLAs that cover operational disruption, not only confirmed data breach.
10. Build a 72-hour answer to "which of our patients, claims, or transactions ran through this vendor in the last 90 days" before the next outage.

Most summaries call Change Healthcare a "ransomware attack" and stop there. That is correct but understates what actually happened.

The first thing people miss is that Change Healthcare was not primarily a data breach. It was an operational shutdown. Pharmacies could not bill. Practices could not verify coverage. Cash flow stopped for weeks. The data exposure, although historic in scale, was a second-order consequence. Most TPRM playbooks were written for data breaches; this incident demanded playbooks for prolonged operational outages.

The second thing people miss is that the most affected organizations had no direct contract with Change Healthcare. They were exposed because their EHR vendor, pharmacy benefit manager, or practice management system used Change Healthcare underneath. The breach traveled two and three relationships deep before reaching the patient.

The third thing people miss is the integration timing. The initial access path was, by the CEO's own testimony, an account without MFA in a recently acquired environment. Post-acquisition integration risk is one of the least-discussed and most consistently dangerous topics in TPRM.

When one vendor becomes national infrastructure, it stops being a vendor risk and becomes a systemic risk. Change Healthcare was the moment US healthcare learned that vendor concentration is not a procurement decision, it is a continuity-of-operations decision, and that the time to discover your single point of failure is before the pipe breaks, not while it is.