Change Healthcare breach shows why MFA is not enough without identity detection

At a glance

What this is: This is a breach analysis of the Change Healthcare incident showing that stolen credentials and missing MFA enabled initial access, but weak identity detection let the attack continue into lateral movement, data theft and ransomware.

Why it matters: It matters because IAM teams cannot treat MFA as a finish line; without monitoring, containment and identity-aware response, compromised access can still become enterprise-wide disruption.

👉 Read Unosecur's analysis of the Change Healthcare breach and identity detection gap

Context

MFA blocks some credential replay paths, but it does not stop an attacker who has already authenticated from probing, moving, and abusing identity pathways inside the environment. In the Change Healthcare case, the initial compromise was tied to a Citrix remote access portal that lacked MFA, which made the access problem visible but not complete.

For IAM and security teams, the deeper issue is identity detection and response after authentication succeeds. Once a session exists, control depends on seeing abnormal access patterns, suspicious API activity, and lateral movement quickly enough to contain them before data theft or ransomware takes hold.

Key questions

Q: What breaks when MFA is not enforced on every remote access path?

A: When MFA is inconsistent, a stolen password can still function as a valid enterprise login, which gives attackers a low-friction entry point into critical systems. That failure is especially dangerous in legacy portals and hybrid environments, where exceptions often persist longest and are hardest to audit.

Q: Why do stolen credentials and misconfigurations keep leading to major breaches?

A: Stolen credentials and misconfigurations remain effective because they exploit ordinary trust assumptions rather than advanced exploits. When access is static, overly broad, or weakly monitored, an attacker needs only one valid entry point to expand access. That is why basic controls such as contextual authorization, strong governance, and rapid remediation often matter more than adding another security layer.

Q: How do teams know whether identity-based detection is working?

A: Look for detections that correlate identity, behaviour, and privilege changes across environments, not just isolated alerts. A working programme should identify unusual pivots between identity types, flag access that no longer matches historical behaviour, and reduce time spent stitching together events after the fact.

Q: What should teams do immediately when a remote access identity behaves unusually?

A: Suspend the session, isolate the account, and check for lateral movement before the attacker can reuse the same identity path elsewhere. The objective is to stop expansion while the compromise is still local, not after it becomes a broader incident.

Technical breakdown

Initial access through a Citrix portal without MFA

A remote access portal is often the first trust boundary for workforce and partner connectivity. If the portal accepts only a password, a stolen credential can behave like a legitimate login even when the user is not legitimate. In this case, the article says attackers used compromised credentials against a Citrix portal that lacked MFA, which removed a key verification step at the perimeter. The problem is not simply weak authentication, but the absence of a second proof that would have forced the attacker to satisfy another factor before entering the environment. This is a classic identity entry failure rather than an infrastructure failure. Practical implication: enforce MFA on every remote access path before exposure expands beyond test or exception accounts.

Practical implication: enforce MFA on every remote access path before exposure expands beyond test or exception accounts.

Why identity detection matters after login succeeds

Once a session is established, attackers can blend into normal user activity unless the organisation is watching for behavioural anomalies. Identity threat detection and response focuses on signals such as unusual API calls, atypical access sequences, suspicious data retrieval and tampering with security controls. That layer matters because authentication controls answer only one question: who got in? They do not answer what the identity did next. The article's emphasis on real-time monitoring reflects the operational gap between access approval and abuse detection. Practical implication: pair authentication with telemetry that can spot abnormal identity behaviour inside the session, not just at the sign-in screen.

Practical implication: pair authentication with telemetry that can spot abnormal identity behaviour inside the session, not just at the sign-in screen.

Lateral movement and exfiltration as the control failure that follows

Lateral movement shows that the attacker is no longer relying on the original access point alone. They are using whatever permissions, sessions, or trust relationships remain available to widen reach and pull data out of the environment. In the article, lateral movement and exfiltration were confirmed before ransomware locked systems, which means the environment lacked timely containment signals strong enough to stop expansion. This is where identity security becomes an operational control problem, not just an authentication problem. Practical implication: treat suspicious movement after initial access as an identity incident and isolate the actor before privilege reuse becomes data loss.

Practical implication: treat suspicious movement after initial access as an identity incident and isolate the actor before privilege reuse becomes data loss.

Threat narrative

Attacker objective: The objective was to extract data and then extort the organisation through ransomware after gaining durable access inside the environment.

1. Entry occurred when attackers used compromised credentials against a Citrix portal that lacked MFA, giving them an authenticated foothold without stronger identity proof.
2. Escalation followed as the intruders moved laterally through the environment and reached additional systems using identity trust that was still available after sign-in.
3. Impact arrived through confirmed data exfiltration and ransomware encryption, which drove operational disruption and major recovery costs.

Breaches seen in the wild

• Change Healthcare breach 2024: A stolen login on a Citrix portal without MFA led to ALPHV ransomware, a $22 million ransom and 192.7 million people affected.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authentication is not a containment strategy: The Change Healthcare case shows that MFA can reduce credential replay risk without stopping post-login abuse. Once the attacker is inside, the deciding factor becomes whether the organisation can detect abnormal identity behaviour and contain it before the session turns into data theft or ransomware. For practitioners, that means treating sign-in control and identity detection as separate layers, not substitutes.

Identity detection has become the missing middle in enterprise access control: Many programmes still invest heavily in proving who the user is and far less in observing what the identity does after entry. That leaves a blind spot between authentication and incident response where lateral movement, exfiltration, and control tampering can occur. The practitioner conclusion is that authenticated access must be continuously inspected, not merely approved.

Compromised-credential resilience depends on reducing post-authentication dwell time: A stolen password or session token should not be enough to preserve attacker mobility for days. The longer an identity remains unchallenged after anomalous use, the more likely the attacker is to chain access into broader compromise. Identity programmes need response logic that shortens that dwell time as a primary control objective.

Identity blast radius is the real governance metric here: The exposed question is not whether MFA was present in theory, but how far a compromised identity could travel once it succeeded. That blast radius is shaped by segmentation, monitoring, privilege scope and offboarding discipline. Teams should measure how quickly they can isolate suspicious identities, because that is what separates credential compromise from enterprise disruption.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Identity detection needs to sit beside MFA in programme design: The Change Healthcare case reinforces a familiar but still under-addressed pattern: the first login control is only the beginning of the security problem. If a programme cannot observe and interrupt abnormal identity behaviour after authentication, it still leaves a large attack window open.

Identity blast radius should become a standard design metric: Teams should ask how far a single compromised access path can travel before containment. That question surfaces the controls that matter most in real incidents: session visibility, privilege scope, segmentation, and the speed of account isolation.

For practitioners

• Enforce MFA on all remote access portals Remove password-only access paths for VPN, Citrix, and similar entry points, including exceptions used by vendors or administrators.
• Instrument identity activity for post-login anomalies Monitor login context, unusual API calls, suspicious data retrieval, and changes to security controls so abuse is visible after authentication succeeds.
• Set containment triggers for lateral movement Define when abnormal identity movement, credential reuse, or access to unexpected systems should trigger isolation of the active session and account.
• Review privileged access paths that survive credential theft Identify which identities can still move across healthcare or shared service environments after one account is compromised, then narrow those paths.
• Tie detection to response playbooks Make sure identity alerts lead to account suspension, session termination, and forensic review, not just dashboard escalation.

Key takeaways

• The breach shows that stolen credentials and missing MFA created entry, but post-login monitoring failures determined how far the attack could go.
• The incident caused major operational and financial harm, including a reported $870 million in Q1 2024 costs and a forecast of $1.4 billion to $1.6 billion for the full year.
• The practical lesson is to pair MFA with identity detection and response so compromised access can be contained before lateral movement and exfiltration escalate into ransomware.

Key terms

• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Post-Authentication Abuse: Post-authentication abuse happens when an attacker uses valid credentials to perform actions after login rather than breaking authentication itself. For NHI environments, this often means abusing tokens, service accounts, or delegated access to query data, move laterally, or establish persistence while appearing legitimate to basic login controls.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• The incident timeline from initial portal access through lateral movement, exfiltration, and ransomware.
• The product screenshots and alert examples showing how identity threat detection flags inactive MFA and suspicious behaviour.
• The specific remediation actions the vendor says it would have triggered during the attack path.
• The discussion of how the vendor maps suspicious activity to MITRE ATT&CK techniques.

👉 The full Unosecur post covers the incident timeline, threat detection examples, and remediation framing.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.