What happened?
On 21 February 2024, UnitedHealth Group disclosed that its subsidiary Change Healthcare — the pipeline that routes roughly one in three US patient records and processes around half of American medical claims — had been hit by ALPHV/BlackCat ransomware, taken offline nationwide. Pharmacies couldn’t verify insurance. Hospitals floated billions in unpaid claims. For weeks, the backbone of US healthcare payments simply stopped. The 23 February publish date here records the full systemic picture as it became undeniable.
Quick Answer: ALPHV/BlackCat ransomware struck Change Healthcare on 21 February 2024, halting claims processing, pharmacy verification, and payments across US healthcare; the outage exposed how a single consolidated clearinghouse became a single point of failure for the entire system — and ended with a reported $22M ransom payment and a second extortion by RansomHub.
The entry path, per UnitedHealth’s congressional testimony: an employee logged into a Citrix remote-access portal without MFA, using credentials already for sale in an infostealer market. From that single session the actors moved laterally for nine days before deploying the encryptor at scale on 21 February. Nine days of reconnaissance inside the machine that moves a third of the country’s health data — exfiltrating an estimated 190 million individuals’ information — which, when confirmed in late 2024, made it the largest healthcare-data breach in US history by an order of magnitude.
What followed operationally was improvised medicine at national scale. Pharmacy counters switched to paper claims and good-faith fills. Hospitals borrowed against receivables — an estimated $100M+ per day in stuck claims during the peak weeks, with rural hospitals, small practices and independent pharmacies taking existential damage. UnitedHealth advanced over $6B in interest-free loans to keep providers solvent. The healthcare system discovered, in real time, that its redundancy plan was a corporate parent’s balance sheet.
Why one company mattered this much
Consolidation built this outage. Decades of mergers collapsed claims routing, eligibility checks, pharmacy adjudication, and payment remittance into one commercial pipeline. When its 111 servers were encrypted, there was no parallel system — switching clearinghouses requires integration work measured in months, not moments. The industry’s efficiency optimization, it turned out, had quietly deleted its failover.
- Claims routing: a third of US patient records flowed through Change Healthcare systems at the time of the attack.
- Pharmacy adjudication: real-time benefit checks failed at the counter — patients walked away or paid cash.
- Payment remittance: hospitals and clinics saw revenue cycles freeze; small providers faced payroll gaps.
- Data concentration: the exfiltrated trove — eventually confirmed at ~190M individuals — is the largest healthcare-data exposure on record.
The nine-day dwell nobody watched
Between 12 and 21 February, the actors reconnoitered at leisure: mapping data stores, staging exfiltration, and preparing the encryption sweep. Detection opportunities existed — anomalous data movement, unfamiliar admin sessions, privilege escalations — but nothing paged. For an organization of Change Healthcare’s criticality, that silent week became the audit finding that mattered most: systemically important infrastructure requires systemically serious monitoring, not just perimeter controls at the front door.
The extortion double-dip
ALPHV took an initial payment — a bitcoin transfer widely reported at $22 million, chain-analyzed in public within weeks. Then the affiliate that actually ran the operation claimed it had been cheated by its own ransomware-as-a-service cartel (ALPHV’s alleged exit scam), and RansomHub stepped in to demand a second ransom for the same data. The victim, in effect, paid twice for one break-in. The affair became the case study for law-enforcement briefings on affiliate-program treachery — and an argument for regulated sectors to treat ransom payments as systemic-risk decisions, not IT line items.
| Date | Event |
|---|---|
| 2024-02-12 | Credential used to access Citrix portal (no MFA); 9-day lateral-movement window begins |
| 2024-02-21 | Encryption detonates; UHG discloses nation-scale outage; ALPHV claims responsibility |
| 2024-02-23 | Systemic impact undeniable: pharmacies, hospitals, payers all affected; Congress begins inquiry letters |
| 2024-03 | Reported $22M ransom payment; services staged back online; loan program expanded past $6B |
| 2024-04 | RansomHub second extortion; UHG testimony confirms breadth; HHS opens the door for claims flexibility |
| 2024-10 | Confirmed scope: ~190 million individuals affected — the largest US healthcare data breach on record |
FAQ
Why did one ransomware attack freeze US healthcare payments?
Because the payments system had been consolidated into one commercial pipeline without regulatory redundancy requirements. Banks have Fedwire fallbacks; power grids have NERC standards; US claims processing had Change Healthcare — singular, efficient, and, once encrypted, irreplaceable in the short term.
Was the Change Healthcare data actually stolen?
Yes. The Department of Health and Human Services’ final accounting put the figure at roughly 190 million individuals — names, SSNs, diagnoses, billing data. The ALPHV and RansomHub extortion chain confirmed the actors held the data; subsequent darkweb leakage episodes kept proving it all year.
What was the initial access vector?
A stolen credential applied to a Citrix portal that lacked MFA. Nine days of post-access dwell followed before encryption. The remediation moral fits in one line: MFA on every external entry point of a systemically important utility — no exceptions, no legacy carve-outs.
The human cost behind the numbers
The statistics flatten what happened at counters and clinics. Patients separated from specialty medications. Rural pharmacies absorbing losses they could not book. Small practices making payroll on credit lines. The provider community’s letters to Congress put faces on the abstraction of “critical infrastructure,” and those letters did more to advance cyber-regulation of health IT than a decade of Worst-case white papers.
Systemic-risk lessons that stuck
Change Healthcare rewired how regulators and executives talk about third-party risk. It stopped being a compliance worksheet and became a financial-stability topic: HHS issued guidance on contingency operations; Congress held hearings on horizontal concentration in health IT; rating agencies began asking insurers and providers about clearinghouse dependencies. The takeaway crystallized for every CISO with a “critical singleton” in their vendor map: concentration risk is outage risk — and your DR plan for a monopoly service is not a runbook, it’s a negotiation position you hold in advance.
