What happened?
On 21 February 2024, UnitedHealth Group disclosed that its subsidiary Change Healthcare — the pipeline that routes roughly one in three US patient records and processes around half of American medical claims — had been hit by ALPHV/BlackCat ransomware, taken offline nationwide. Pharmacies couldn’t verify insurance. Hospitals floated billions in unpaid claims. For weeks, the backbone of US healthcare payments simply stopped. The 23 February publish date here records the full systemic picture as it became undeniable.
Quick Answer: ALPHV/BlackCat ransomware struck Change Healthcare on 21 February 2024, halting claims processing, pharmacy verification, and payments across US healthcare; the outage exposed how a single consolidated clearinghouse became a single point of failure for the entire system — and ended with a reported $22M ransom payment and a second extortion by RansomHub.
The entry path, per UnitedHealth’s congressional testimony: an employee logged into a Citrix remote-access portal without MFA, using credentials already for sale in an infostealer market. From that single session the actors moved laterally for nine days before deploying the encryptor at scale on 21 February. Nine days of reconnaissance inside the machine that moves a third of the country’s health data — exfiltrating an estimated 190 million individuals’ information — which, when confirmed in late 2024, made it the largest healthcare-data breach in US history by an order of magnitude.
What followed operationally was improvised medicine at national scale. Pharmacy counters switched to paper claims and good-faith fills. Hospitals borrowed against receivables — an estimated $100M+ per day in stuck claims during the peak weeks, with rural hospitals, small practices and independent pharmacies taking existential damage. UnitedHealth advanced over $6B in interest-free loans to keep providers solvent. The healthcare system discovered, in real time, that its redundancy plan was a corporate parent’s balance sheet.
Why one company mattered this much
Consolidation built this outage. Decades of mergers collapsed claims routing, eligibility checks, pharmacy adjudication, and payment remittance into one commercial pipeline. When its 111 servers were encrypted, there was no parallel system — switching clearinghouses requires integration work measured in months, not moments. The industry’s efficiency optimization, it turned out, had quietly deleted its failover.
- Claims routing: a third of US patient records flowed through Change Healthcare systems at the time of the attack.
- Pharmacy adjudication: real-time benefit checks failed at the counter — patients walked away or paid cash.
- Payment remittance: hospitals and clinics saw revenue cycles freeze; small providers faced payroll gaps.
- Data concentration: the exfiltrated trove — eventually confirmed at ~190M individuals — is the largest healthcare-data exposure on record.
The nine-day dwell nobody watched
Between 12 and 21 February, the actors reconnoitered at leisure: mapping data stores, staging exfiltration, and preparing the encryption sweep. Detection opportunities existed — anomalous data movement, unfamiliar admin sessions, privilege escalations — but nothing paged. For an organization of Change Healthcare’s criticality, that silent week became the audit finding that mattered most: systemically important infrastructure requires systemically serious monitoring, not just perimeter controls at the front door.
The extortion double-dip
ALPHV took an initial payment — a bitcoin transfer widely reported at $22 million, chain-analyzed in public within weeks. Then the affiliate that actually ran the operation claimed it had been cheated by its own ransomware-as-a-service cartel (ALPHV’s alleged exit scam), and RansomHub stepped in to demand a second ransom for the same data. The victim, in effect, paid twice for one break-in. The affair became the case study for law-enforcement briefings on affiliate-program treachery — and an argument for regulated sectors to treat ransom payments as systemic-risk decisions, not IT line items.
| Date | Event |
|---|---|
| 2024-02-12 | Credential used to access Citrix portal (no MFA); 9-day lateral-movement window begins |
| 2024-02-21 | Encryption detonates; UHG discloses nation-scale outage; ALPHV claims responsibility |
| 2024-02-23 | Systemic impact undeniable: pharmacies, hospitals, payers all affected; Congress begins inquiry letters |
| 2024-03 | Reported $22M ransom payment; services staged back online; loan program expanded past $6B |
| 2024-04 | RansomHub second extortion; UHG testimony confirms breadth; HHS opens the door for claims flexibility |
| 2024-10 | Confirmed scope: ~190 million individuals affected — the largest US healthcare data breach on record |
FAQ
Why did one ransomware attack freeze US healthcare payments?
Because the payments system had been consolidated into one commercial pipeline without regulatory redundancy requirements. Banks have Fedwire fallbacks; power grids have NERC standards; US claims processing had Change Healthcare — singular, efficient, and, once encrypted, irreplaceable in the short term.
Was the Change Healthcare data actually stolen?
Yes. The Department of Health and Human Services’ final accounting put the figure at roughly 190 million individuals — names, SSNs, diagnoses, billing data. The ALPHV and RansomHub extortion chain confirmed the actors held the data; subsequent darkweb leakage episodes kept proving it all year.
What was the initial access vector?
A stolen credential applied to a Citrix portal that lacked MFA. Nine days of post-access dwell followed before encryption. The remediation moral fits in one line: MFA on every external entry point of a systemically important utility — no exceptions, no legacy carve-outs.
The human cost behind the numbers
The statistics flatten what happened at counters and clinics. Patients separated from specialty medications. Rural pharmacies absorbing losses they could not book. Small practices making payroll on credit lines. The provider community’s letters to Congress put faces on the abstraction of “critical infrastructure,” and those letters did more to advance cyber-regulation of health IT than a decade of Worst-case white papers.
Systemic-risk lessons that stuck
Change Healthcare rewired how regulators and executives talk about third-party risk. It stopped being a compliance worksheet and became a financial-stability topic: HHS issued guidance on contingency operations; Congress held hearings on horizontal concentration in health IT; rating agencies began asking insurers and providers about clearinghouse dependencies. The takeaway crystallized for every CISO with a “critical singleton” in their vendor map: concentration risk is outage risk — and your DR plan for a monopoly service is not a runbook, it’s a negotiation position you hold in advance.
Where this sits in the broader pattern
Change Healthcare (February 2024) is the modern apex of the single-vendor systemic-risk genre: one unit of UnitedHealth processing roughly half of US medical claims, hit by ALPHV/BlackCat ransomware, producing a national healthcare payment outage measured in weeks and a one-company, 190-million-person breach disclosure. The Rackspace entry in this series shows the same shape at service-provider scale; this one shows it at infrastructure scale.
The double-dip extortion defined the aftermath: ALPHV took a reported 22-million-dollar ransom, then an affiliate — holding its own copy of the data — extorted separately, and UnitedHealth reportedly paid again before data nonetheless leaked. For every organization contemplating ransom economics, the incident is the case study that payment does not close the incident; it funds the next demand from a different counterparty holding the same assets.
The systemic lessons stuck because regulators and Congress made them stick: hearings on clearinghouse concentration, scrutiny of single-point-of-failure dependencies in healthcare payments, and executive-level accountability conversations that reshaped how boards price systemic dependency. The consolidation with this series: concentration is a security decision, dependency maps are security artifacts, and the question what breaks if this one vendor stops is now a board question everywhere — because one afternoon in February 2024 answered it for an entire industry.
The bottom line. One ransomware detonation stopped prescriptions, claims, and payments across a country — and the ransoms paid did not even buy deletion. Map your single points of failure, price your dependencies honestly, rehearse operating without your critical vendors, and treat extortion economics as multi-counterparty by default. The next Change Healthcare is currently someone un-mapped dependency; the mapping is the entire defense.
Detection and response lessons from the clearinghouse
Beyond the systemic story, the incident-level lessons are concrete. The initial access was a Citrix portal without MFA — the same machine-identity and remote-access gap this series documents in Snowflake, TeamCity, and the Snowflake-Ticketmaster entry. Nine days of dwell time followed before encryption, during which the intrusion produced telemetry nobody was watching. The controls that shorten that window — MFA on every remote entry point, egress monitoring from core processing systems, behavioral baselines on privileged accounts — are commodity capabilities, and their absence at this scale of infrastructure is the enduring scandal of the incident.
The recovery economics deserve study too: UnitedHealth advanced billions in interest-free loans to providers to keep practices solvent while payment systems were down — quantifying, precisely, the hidden systemic cost that dependency concentration creates. That advance is the clearest public pricing of what single-vendor dependency actually costs when it fails: not the vendor outage, but the industry payroll it interrupts. Boards across every sector should read that number as the benchmark for their own dependency-mapping exercises.
And the data-side aftermath: with 190 million individuals affected, the notification and remediation program became one of the largest consumer-security operations ever run — multi-year, court-supervised, and precedent-setting for what regulators will expect from mega-breaches. The incident thus wrote three playbooks at once: how an intrusion should have been detected, how a dependency should have been priced, and how a mega-breach must be remediated. Every organization operating critical infrastructure should hold all three.
The dependency map, the MFA coverage, the egress monitoring — three artifacts, one board conversation. Schedule it.
Three artifacts, one conversation, one afternoon — the cheapest risk reduction in this entire series.
Frequently Asked Questions
{“@context”:”https://schema.org”,”@type”:”FAQPage”,”mainEntity”:[{“@type”:”Question”,”name”:”What happened in the Change Healthcare ransomware attack?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”In February 2024, ALPHV/BlackCat ransomware hit Change Healthcare — the unit processing roughly half of US medical claims — causing weeks of nationwide disruption to pharmacy, claims, and payment systems, and ultimately exposing data on about 190 million people.”}},{“@type”:”Question”,”name”:”Why did Change Healthcare pay ransom twice?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”After a reported 22-million-dollar payment to ALPHV, a different affiliate holding its own copy of the stolen data extorted separately — illustrating that ransom payment settles with one counterparty while the data remains a reusable asset for others.”}},{“@type”:”Question”,”name”:”What is the systemic lesson of the Change Healthcare attack?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Vendor concentration creates national-scale single points of failure: one company outage became an industry-wide healthcare crisis. Organizations must map critical-vendor dependencies and rehearse continuity without them.”}}]}
Related Reading
- What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
- Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
- 2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor
- Authoritative reference: CISA Known Exploited Vulnerabilities
- Guardian Ransomware: The Newsroom That Kept Printing
- Royal Mail vs LockBit: The $80M Ransom Refusal
- CDK Global Ransomware: US Car Dealerships Run on Pen and Paper
