Change Healthcare shows how MFA gaps become ransomware exposure

At a glance

What this is: NHI Mgmt Group's analysis, drawing on 1Kosmos's research: In the Change Healthcare ransomware incident, a missing MFA control on remote access enabled credential abuse and extended intruder dwell time.

Why it matters: It matters because healthcare IAM teams still have to treat remote access assurance as a live control objective, especially where stolen credentials can become a ransomware foothold.

Context

Change Healthcare is a reminder that remote access is only as strong as the identity controls at the front door. In this case, the article says the breach began with an absent MFA control on a remote access application, which allowed compromised employee credentials to be used against internal systems.

For healthcare organisations, the issue is not just initial authentication. Once an attacker gets past a remote access control with valid credentials, the identity layer becomes part of the ransomware path, not just the login layer.

The article also notes that attackers remained inside the environment for nine days before launch. That makes the starting posture look typical for organisations that rely on single-factor remote access and assume credential possession is enough to prove trust.

Key questions

Q: What breaks when a remote access portal does not require MFA?

A: Password-only remote access turns stolen credentials into immediate session access, which means the attacker can enter through a normal user path and blend into routine activity. In a high-value environment, that single failure can become lateral movement, data theft, and ransomware if detection and containment are not already tuned to identity behaviour.

Q: Why do stolen credentials make ransomware outbreaks harder to contain?

A: Stolen credentials matter because they turn the attacker into a valid user, which often bypasses basic trust checks. If those credentials belong to privileged users or support staff, the operator can enumerate systems, request access, and move through approved channels. That is why identity lifecycle, MFA resistance, and privilege scoping are central to containment.

Q: How can security teams tell if remote access controls are failing?

A: Look for successful logins from accounts that should not normally use remote access, longer-than-expected sessions, and suspicious movement after authentication. Those signals often show that the control problem is not denial at the door, but weak assurance after entry.

Q: Who is accountable when a remote access pathway gives an attacker broad internal reach?

A: Accountability usually sits across IAM, infrastructure, and application owners, but the control failure is often a governance issue rather than a single technical mistake. Teams should be able to show who approved the access model, who owns third-party access, and who is responsible for revocation.

Technical breakdown

How remote access without MFA expands credential abuse

Remote access applications sit at a high-value boundary because they convert an external login into internal network reach. Without MFA, a stolen password can be enough to pass the front door, especially when the attacker already has a valid username and can blend in as a normal user. In identity terms, the control failure is not that authentication disappeared, but that the authentication proof was too weak for the access being granted. This is a classic remote-access identity gap: the session looks legitimate at entry, yet the assurance level does not match the sensitivity of the environment.

Practical implication: tie remote access to stronger authentication assurance than password-only login.

Why stolen credentials become a ransomware foothold

Ransomware campaigns often begin with valid access rather than noisy exploitation. Once a credential works, the attacker can authenticate, explore, and position for later action without triggering the same alarms as malware delivery or vulnerability exploitation. That makes identity controls upstream of the ransomware payload, not separate from it. In a healthcare setting, the consequence is broader because access to scheduling, claims, and care coordination systems can disrupt services well before encryption occurs. The breach pattern shows that compromised credentials are not an endpoint, but an enablement layer for later impact.

Practical implication: monitor for valid-account abuse as an early ransomware indicator, not just encryption events.

How dwell time reflects control failure, not just attacker patience

Nine days of intruder presence usually means the environment lacked enough identity, access, or monitoring friction to force early containment. Dwell time matters because it gives attackers room to enumerate systems, test privileges, and prepare the final disruptive step. In this case, the article frames the delay as part of the attack story, which points to a governance problem: authenticated access was allowed to persist long enough to become operationally useful to the attacker. That is an access governance failure, not only a detection failure.

Practical implication: measure how long unauthorised sessions can survive after initial credential abuse.

Threat narrative

Attacker objective: The objective was to use valid access to establish a foothold, prepare inside the network, and then deploy ransomware for maximum disruption.

1. Entry occurred through a remote access application where the absence of MFA let compromised employee credentials open the door.
2. Credential abuse gave the attackers authenticated access to internal systems, allowing them to remain inside the environment without immediate interruption.
3. The attackers lurked for nine days before launching ransomware, turning identity compromise into service disruption across the United States.

Breaches seen in the wild

• Change Healthcare breach 2024: A stolen login on a Citrix portal without MFA led to ALPHV ransomware, a $22 million ransom and 192.7 million people affected.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MFA is not a checkbox when remote access is the entry point: The Change Healthcare case shows that single-factor remote access is a structural weakness, not a minor hardening gap. When stolen credentials are enough to establish a session, the identity layer has already failed as a boundary control. The practitioner lesson is that remote access assurance must match the sensitivity of the systems it reaches.

Credential possession and identity assurance are no longer equivalent: This incident illustrates a core governance problem in modern access design, where knowing a password no longer proves meaningful user legitimacy. SIM swapping, OTP theft, and social engineering all weaken the assumption that possession implies trust. The implication is that remote access programmes need stronger proofing and authentication alignment than legacy login checks provide.

Identity assurance is part of ransomware prevention, not just access administration: The breach worked because attackers moved from credential compromise to authenticated internal presence before the ransomware event. That makes access governance an upstream incident-control domain, not a separate IAM hygiene task. Healthcare teams should treat identity controls as resilience controls because they determine whether intrusion becomes disruption.

Change Healthcare exposes the remote access trust gap: Remote access was treated as an ordinary login path, but the attack shows that it functioned as a high-risk control plane for enterprise compromise. Once that trust gap exists, every downstream security tool has less time to respond. Practitioners should re-evaluate where their environment still assumes password-only assurance is sufficient.

Remote access assurance needs lifecycle thinking: The article points to a control posture that assumes authenticated access is safe until proven otherwise. That assumption fails when the access path itself is the weakness and attackers can preserve it long enough to stage ransomware. The implication is that access review, monitoring, and response need to be designed around the risk of valid-account abuse, not just unauthorized logins.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• 55% of healthcare data breaches now originate from a third-party vendor, according to Ponemon Institute’s 2023 Third-Party Risk in Healthcare report.
• Read next: Remote Access Identity Guide

What this signals

Remote access trust gap: Healthcare environments still expose a recurring mismatch between what a login proves and what the session can actually reach. When password-only access opens production pathways, the control failure is already visible before ransomware appears, so monitoring has to start at authentication success rather than encryption events.

The Change Healthcare pattern also reinforces a broader identity lesson: attackers increasingly use legitimate access paths to create operational delay before impact. That means access assurance, session governance, and rapid revocation are part of ransomware preparedness, not just account administration.

According to the State of Secrets in AppSec, 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases. The same basic concern applies here: once trust is misplaced at the identity boundary, downstream systems inherit the risk.

For practitioners

• Tighten remote access MFA requirements Require MFA on every remote access path that can reach sensitive production or healthcare systems, and remove password-only exceptions for staff and privileged users.
• Review credential-based entry points Inventory remote access applications, VPNs, and external portals that still accept single-factor authentication, then prioritize the ones with the broadest internal reach.
• Shorten the time valid sessions remain useful Pair session monitoring with fast revocation workflows so suspicious authenticated access cannot persist long enough to support ransomware staging.
• Strengthen identity proofing for high-risk access Use stronger identity proofing and authentication assurance where the user can reach claims, patient, or operational systems from outside the network.
• Treat valid-account abuse as an intrusion signal Alert on unusual remote access patterns, especially successful logins from accounts that should not normally traverse the same access path or time window.

Key takeaways

• The breach shows how missing MFA on remote access can turn stolen credentials into internal footholds for ransomware.
• The article says the attackers remained inside the environment for nine days before the disruptive phase began.
• The control lesson is straightforward: remote access assurance must be strong enough to stop valid-account abuse before it becomes service disruption.

Key terms

• Remote Access Identity: Remote access identity is the trust relationship used when a person or workload connects from outside the internal network. In practice, it combines authentication strength, device or session assurance, and the permissions granted after login, which makes it a high-risk control point for credential abuse.
• Multi-Factor Authentication: Multi-factor authentication requires two or more independent verification factors before access is granted. In practice, it reduces the chance that a stolen password alone will open a system, but it only works well when applied consistently across all high-risk access paths and identity types.
• Valid Account Abuse: Valid account abuse occurs when attackers use legitimate credentials or tokens to enter systems and blend in with normal traffic. It is a preferred tactic because it sidesteps many exploit-based controls and inherits existing privilege. In NHI programmes, service accounts and API keys are common abuse paths when scope and rotation are weak.
• Identity Assurance: The confidence an organisation has that a person or system is truly who it claims to be before access or action is granted. In modern IAM, assurance depends on evidence quality, channel trust, and the strength of verification around high-risk decisions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.