Change Healthcare Ransomware: The Largest Healthcare Breach
The Change Healthcare ransomware attack in February 2024 exposed protected health information of approximately 100 million Americans, making it the largest healthcare breach in US history. The attack disrupted prescription processing, medical billing, and healthcare operations nationwide for weeks. Parent company UnitedHealth Group paid $22 million ransom to BlackCat ransomware group. The breach exposed names, addresses, dates of birth, Social Security numbers, medical records, billing information, and insurance details.
Attack Details
The ALPHV/BlackCat ransomware group accessed Change Healthcare systems through a Citrix portal that lacked multi-factor authentication. The attackers exfiltrated approximately 6 TB of data over weeks before deploying ransomware. Initial detection on February 21, 2024 led to system shutdown that disrupted healthcare nationwide. UnitedHealth paid $22 million ransom but data was still leaked online by an affiliated group.
Healthcare Disruption
The attack disrupted prescription processing affecting pharmacy claims for weeks. Medical providers could not bill insurance and faced cash flow crises. Some patients could not fill prescriptions or receive elective care. The HHS issued guidance allowing flexibility in claims processing. The disruption demonstrated the systemic risk of healthcare technology consolidation under one company.
Regulatory Response
HHS opened investigations into Change Healthcare cybersecurity practices. Congressional hearings examined the lack of basic security controls including MFA. UnitedHealth Group acknowledged the absence of MFA on the compromised system. Class action lawsuits proceed against UnitedHealth. The breach contributed to legislative proposals for healthcare cybersecurity requirements.
Key Findings
- Approximately 100 million Americans had protected health information exposed in the breach
- UnitedHealth Group paid $22 million ransom to BlackCat ransomware group
- Compromised Citrix portal lacked basic multi-factor authentication
Timeline
Change Healthcare detects ransomware attack
UnitedHealth pays $22 million ransom
HHS confirms 100 million affected individuals