What happened
On February 12, 2024, criminals used compromised credentials to remotely access a Change Healthcare Citrix portal — the gateway employees use to reach their systems from outside the office. Change Healthcare is the clearinghouse behind a vast share of U.S. medical claims: its systems touch roughly one in every three patient records in the United States.
For nine days the intruders moved through the network and exfiltrated data. On February 21 they deployed ransomware, attributed to ALPHV — also known as BlackCat. Claims processing froze nationwide; pharmacies could not verify insurance, and providers across the country were cut off from the payments that keep them running.
UnitedHealth Group, Change Healthcare's parent, paid a ransom: on March 1, blockchain analysts watched 350 bitcoin — roughly $22 million — move into a wallet linked to ALPHV. It bought nothing. The affiliate who carried out the attack later claimed ALPHV's leaders had vanished with the money, still holding the stolen data — and a second extortion attempt followed.
The open door
The portal had no multi-factor authentication. As UnitedHealth's CEO later testified to Congress, the Citrix portal was not protected by MFA — so a single stolen password was the entire lock on a door into the plumbing of American healthcare. No zero-day, no broken encryption: one credential, one legacy remote-access path, nobody's inventory.
The cost
UnitedHealth's final accounting put the total impact at $3.09 billion: $2.22 billion in direct response costs and $867 million in business disruption — more than double the company's first estimate. The human count took longer to settle: first filed at 100 million people, the figure on the Department of Health and Human Services breach portal now stands at 192.7 million individuals, the largest healthcare breach notification operation in history — for medical data that, unlike a credit card, can never be reissued.
What boards should do
- MFA on 100% of remote access — including every legacy portal, especially the inherited ones nobody remembers owning.
- Inventory every remote-access path with a named owner; a gateway without an owner is a gateway without a lock.
- Model single points of failure: if one vendor's outage can freeze your revenue or your care delivery, that concentration is a board-level risk, priced in advance.
- Decide the ransom policy before the incident — who decides, on what criteria, with what counsel — because, as this case shows, paying buys a promise from criminals, with no enforcement mechanism.