Change Healthcare ransomware via a Citrix remote access portal without MFA

On February 12, 2024 attackers used compromised credentials to log into a Change Healthcare Citrix remote access portal that did not have MFA, moved laterally, exfiltrated data and deployed ransomware on February 21. UnitedHealth disclosed in an 8-K on February 22; the outage disrupted claims and pharmacy payments across the US health system for weeks. CEO Andrew Witty confirmed the missing MFA in written testimony to Congress released April 30, 2024.

Victim

Change Healthcare (UnitedHealth Group)

Industry

Healthcare

Country

United States

Intrusion began

Feb 12, 2024

First disclosed

Feb 22, 2024

Actor

ALPHV/BlackCat affiliate (Extortion group)

Initial access

Stolen credentials

Identity control that failed

Authentication

MFA

Not enforced on the abused account

Abused identity

Human account

Records affected

192.7 million (Individuals, per Change Healthcare's updated filing with HHS OCR (July 2025). UnitedHealth's 2024 10-K estimated about 190 million; the count is not fully deduplicated.)

Disclosed cost

$3.07 billion (UnitedHealth's 2024 10-K: $2.2 billion of direct response costs plus $867 million of estimated Optum Insight business disruption for 2024. Excludes later years.)