Change Healthcare: one MFA-less login let hackers stall US healthcare for weeks

In February 2024, attackers logged into a Change Healthcare Citrix remote-access portal that had no multi-factor authentication, using stolen credentials. UnitedHealth Group's CEO later confirmed at a Senate hearing that they moved laterally for nine days and exfiltrated about six terabytes of data before detonating ALPHV/BlackCat ransomware on February 21. UnitedHealth, which owns Change Healthcare, disconnected the platform — and with it the pipes that move claims and payments through US healthcare.

Pharmacies could not verify insurance; doctors could not bill. Patients paid cash for medication or went without it. Providers — small practices above all — lost an estimated $100 million a day at the peak, and some neared insolvency. HHS opened emergency flexibilities for hospitals and its civil-rights office launched an investigation, while UnitedHealth began advancing billions in emergency payments to keep providers afloat.

In March, a $22 million Bitcoin payment to an ALPHV wallet surfaced — later confirmed by UnitedHealth's own CEO. Data for about 190 million people turned out to be exposed, the largest healthcare data breach ever reported to US regulators. And the entry point, by the company's own Senate testimony, was a remote-access portal that lacked multi-factor authentication.

190 million people's data — the largest healthcare breach ever reported; up to $100M a day in provider losses; a $22M ransom paid in Bitcoin.

A remote-access portal with production access ran without multi-factor authentication — the one control that would have stopped stolen credentials cold.

The claims-and-payments network was a single national choke point: when it went dark, pharmacies, clinics and hospitals across the country lost their billing rails at once.

Ransomware detonated nine days after the intrusion with no one catching the lateral movement — detection lagged far behind the attackers' dwell time.

One unauthenticated door can stop a nation's hospitals getting paid. Enforce MFA everywhere and stress-test for the day your single point of failure becomes everyone else's.

Witty testified before the Senate Finance Committee on May 1, 2024, confirming the $22 million ransom and the missing MFA. In October 2024 UnitedHealth reported 100 million affected individuals; by January 2025 the estimate had nearly doubled to 190 million. Dozens of lawsuits were consolidated into a Minnesota multidistrict litigation, the HHS civil-rights investigation stayed open, and the episode became the reference case for the national risk of concentrating US health payments in one company.