incident · 1708473600000

Change Healthcare Ransomware Attack

Change Healthcare, a major processor of U.S. medical claims and a subsidiary of UnitedHealth Group, suffered a ransomware attack by the ALPHV (BlackCat) group, leading to nationwide disruptions in healthcare services.

What happened

On February 21, 2024, UnitedHealth Group detected that a cyber threat actor had gained access to Change Healthcare's IT systems. The attackers exfiltrated sensitive data and deployed ransomware, prompting the company to isolate affected systems.

Technical mechanism

The attackers, attributed to the ALPHV/BlackCat ransomware group, exploited compromised credentials. According to reports, a lack of multi-factor authentication on a legacy server allowed initial access, followed by data exfiltration and ransomware deployment.

Why it matters

This attack severely disrupted the U.S. healthcare system, causing an estimated $2.87 billion in costs to UnitedHealth Group in 2024 and exposing the sensitive health information of potentially millions of individuals, highlighting critical vulnerabilities in healthcare supply chains.

Impact

The incident halted electronic payments and medical claims processing nationwide, forcing patients to pay out-of-pocket and delaying care. UnitedHealth Group reported an estimated cost of $2.87 billion in 2024 and provided over $6 billion in assistance to providers. A $22 million ransom was reportedly paid.

Response

UnitedHealth Group proactively isolated impacted systems, engaged security experts and law enforcement, and provided financial assistance to affected healthcare providers. The U.S. Department of Health and Human Services (HHS) opened an investigation into the breach.

Defensive lessons

  • Implement Multi-Factor Authentication (MFA) on all external-facing systems, especially legacy servers.
  • Enhance third-party risk management and supply chain security in critical sectors like healthcare.
  • Develop and test robust incident response and business continuity plans for large-scale disruptions.

Evidence register

  1. U.S. Securities and Exchange Commission — Form 8-K: UnitedHealth Group Incorporated (verified)
  2. U.S. Department of Health and Human Services — Change Healthcare Cybersecurity Incident Frequently Asked Questions (verified)