Quick answer: In February 2024, criminals used stolen credentials to log in to a Change Healthcare remote access portal that did not have multifactor authentication. Nine days later the ALPHV/BlackCat ransomware group deployed ransomware, disrupting claims processing and pharmacies across the United States. UnitedHealth Group, Change Healthcare’s parent company, paid a ransom, and the number of people affected was later put at about 192.7 million, the largest healthcare breach in US history.
| Key facts | |
|---|---|
| Date | Initial access 12 February 2024; ransomware deployed nine days later (21 February 2024) |
| Organization | Change Healthcare, part of UnitedHealth Group |
| Type of attack | Ransomware with data theft |
| Attacker | ALPHV/BlackCat ransomware group |
| Impact | About 192.7 million people affected; claims and pharmacy payments disrupted nationwide |
| How they got in | Stolen credentials on a Citrix remote access portal without MFA, according to CEO Andrew Witty |
Timeline
- 12 February 2024: Criminals use compromised credentials to access a Change Healthcare Citrix portal without MFA.
- 21 February 2024: Ransomware is deployed after the attackers move through the network and steal data.
- 1 May 2024: UnitedHealth CEO Andrew Witty testifies to Congress and confirms the missing MFA and the ransom payment decision.
- October 2024: The breach is listed on the US health department’s breach portal at 100 million people.
- July 2025: The estimate is revised to about 192.7 million individuals.
What happened
Change Healthcare processes a huge share of US medical claims and pharmacy payments. When ransomware hit in February 2024, hospitals, clinics and pharmacies across the country could not process claims or verify prescriptions normally for weeks.
In written testimony to the US House Energy and Commerce Committee on 1 May 2024, UnitedHealth Group CEO Andrew Witty said: “On February 12, criminals used compromised credentials to remotely access a Change Healthcare Citrix portal.” He confirmed the portal did not have multifactor authentication, that the attackers moved through the systems and stole data, and that ransomware was deployed nine days later.
The ransom
Witty took personal responsibility for paying, saying the decision to pay a ransom was his. Press reports put the payment at about $22 million to ALPHV/BlackCat. Paying did not end the damage: the stolen data still affected about 192.7 million people according to the latest estimate filed with the US Department of Health and Human Services.
Why it became so large
Change Healthcare sits at the center of the US health system. One company’s missing MFA on one portal affected patients, providers and pharmacies nationwide. This is concentration risk: when many organizations depend on one supplier, that supplier’s weaknesses become everyone’s problem.
Lessons for your organization
- Require MFA on every remote access portal and external system, with no exceptions for legacy tools.
- Find and retire forgotten remote access systems, which are common entry points.
- Monitor for attackers moving inside the network: there were nine days between access and ransomware.
- Map critical suppliers and plan for what happens if one of them goes offline for weeks.
- Decide your ransom policy in advance, with legal and law enforcement input.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. Learn more about how ransomware works. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Frequently asked questions
How did hackers get into Change Healthcare?
They used stolen credentials to log in to a Citrix remote access portal that did not have multifactor authentication, according to UnitedHealth CEO Andrew Witty’s testimony.
How many people were affected by the Change Healthcare breach?
About 192.7 million people, according to the figure Change Healthcare filed with the US health department in July 2025.
Did Change Healthcare pay the ransom?
Yes. CEO Andrew Witty said the decision to pay was his. Press reports put the payment at about $22 million.
