TL;DR: Change Healthcare’s ransomware attack shows how compromised credentials without MFA can still bypass enterprise defenses, even in heavily regulated environments, according to Hydden. The case reinforces that identity hygiene, visibility, and control enforcement remain operationally difficult across hybrid estates, SaaS, and non-human identities.
At a glance
What this is: Hydden argues that the Change Healthcare ransomware case shows how weak identity hygiene, especially missing MFA and poor visibility, can still open a path to major data theft in hybrid IAM estates.
Why it matters: For IAM, PAM, and NHI teams, the case shows that identity policy only matters when coverage, inventory, and enforcement are continuous across cloud, on-premises, SaaS, and non-human accounts.
Context
Identity hygiene is the discipline of making sure accounts, credentials, and access controls are actually enforced across the estate, not just defined in policy. In hybrid IAM environments, that means the control has to hold across legacy systems, cloud workloads, SaaS, remote access, and non-human identities.
Hydden uses the Change Healthcare ransomware incident as its anchor because it shows how a familiar control failure can still create a large-scale breach path. The article’s broader point is that identity security programmes often know the requirement, but struggle to verify it everywhere that matters.
Key questions
Q: What breaks when MFA is not enforced on every remote access path?
A: When MFA is inconsistent, a stolen password can still function as a valid enterprise login, which gives attackers a low-friction entry point into critical systems. That failure is especially dangerous in legacy portals and hybrid environments, where exceptions often persist longest and are hardest to audit.
Q: Why do hybrid identity environments increase ransomware risk?
A: Hybrid environments increase ransomware risk because identity data is fragmented across directories, SaaS, and on-premises systems, making it hard to prove control coverage. If teams cannot see every account and access path, they cannot reliably enforce MFA, privilege limits, or access reviews across the full estate.
Q: How do teams know whether identity hygiene is actually improving?
A: Look for fewer dormant accounts, fewer orphaned privileges, and shorter time-to-removal for leavers and role changes. A healthy programme can show that identity objects are being retired as fast as business context changes, rather than accumulating hidden access over time.
Q: How should security teams run access reviews for non-human identities?
A: Security teams should scope reviews by risk pattern, assign every identity to an accountable owner, and require a documented decision for each item in scope. The workflow should allow direct remediation for obvious cases and owner follow-up for the rest. The goal is not just certification but a clean audit trail and a clear end state for each credential.
Technical breakdown
How compromised credentials bypass identity controls in hybrid estates
The breach pattern begins when attackers obtain valid credentials and reach a remote access entry point, in this case a Citrix portal. Once authentication succeeds, perimeter controls often lose relevance because the session is treated as legitimate unless additional checks, such as MFA or contextual verification, are enforced. In hybrid estates, inconsistent identity policy across directories, SaaS, and legacy systems creates uneven protection zones, which attackers can target for the weakest path in. That is why credential misuse remains a durable ransomware entry technique rather than an obsolete one.
Practical implication: identity teams need to verify where MFA and conditional access are actually enforced, not where policy says they should be.
Why identity visibility is the control behind control enforcement
Visibility is the prerequisite for identity hygiene because organisations cannot enforce what they cannot inventory. Large environments often contain multiple Active Directories, cloud and on-premises workloads, SaaS accounts, and non-human identities, each with different ownership and lifecycle rules. When those identities are not fully discovered, correlated, and classified, MFA gaps, stale accounts, and privilege exceptions remain hidden. The operational problem is not only the presence of weak accounts, but the inability to see them quickly enough to close exposure windows before attackers exploit them.
Practical implication: build a complete identity inventory before expecting consistent enforcement across the access estate.
Why non-human identities now belong in the identity hygiene model
The article’s reference to non-human identities matters because modern access sprawl is no longer limited to people. Service accounts, application accounts, and machine credentials can create the same governance blind spots as human accounts if they are not catalogued, monitored, and constrained. In a hybrid environment, security teams that focus only on user access miss a major share of the attack surface, especially where automation and SaaS integrations generate standing access. That broadens identity hygiene from a login problem to an access lifecycle problem across all identity types.
Practical implication: extend identity governance and review processes to service accounts, application credentials, and other non-human identities.
Threat narrative
Attacker objective: The objective was to gain authenticated access, steal sensitive data, and use the access foothold to support a ransomware event with broad operational and privacy impact.
- Attackers gained entry through compromised login credentials that lacked MFA and used them to reach a Citrix portal.
- The authenticated session enabled access to corporate systems and data without immediately triggering stronger identity verification.
- The actors exfiltrated corporate data, including PHI, and used the access path as part of the ransomware operation.
- The result was operational disruption at a unit handling about 50% of U.S. medical claims, turning identity weakness into broad impact.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity hygiene failures are still a live ransomware control gap, not a solved problem. The Change Healthcare case shows that a well-known control like MFA can still be absent at the exact point of entry attackers choose. That means the real failure is not awareness, but inconsistent enforcement across a hybrid estate. The practitioner implication is that identity hygiene must be treated as an operational control plane, not a policy statement.
Visibility is the prerequisite for identity enforcement in hybrid IAM. Organisations with multiple Active Directories, SaaS applications, cloud workloads, and non-human identities cannot secure what they cannot fully enumerate. When identity inventory is incomplete, exceptions become permanent by default and MFA coverage becomes unverifiable. The field should stop treating visibility as reporting and start treating it as the control substrate for identity governance.
Hybrid identity risk now includes non-human access paths, not just user credentials. Once service accounts, application identities, and machine credentials are part of the same access fabric, hygiene gaps can propagate beyond human login failures. That changes the governance problem from user authentication to identity lifecycle control across all account types. The practitioner conclusion is that identity programmes must govern every account that can reach production systems.
Phishing-resistant authentication is not the only strategic answer, but it is a test of programme maturity. CISOs may resist full passwordless migration because of cost and operational risk, yet the article shows how expensive the alternative becomes after compromise. The market signal is that identity security is converging with vulnerability management discipline, where continuous discovery and remediation matter more than static control intent. Practitioners should benchmark identity controls by coverage and enforceability, not by adoption rhetoric.
Identity security is now a core cyber defence function, not an IAM back-office exercise. The article reflects a broader shift in which identity blind spots create direct breach pathways, business interruption, and data exposure. That elevates identity hygiene into board-level resilience planning because access control failures now translate into operational and regulatory consequences. Security leaders should align IAM, PAM, and NHI governance under one measurable programme.
From our research library:
- 55% of healthcare data breaches now originate from a third-party vendor, according to Ponemon Institute’s 2023 Third-Party Risk in Healthcare report.
What this signals
Identity hygiene is becoming a resilience issue, not just an access management issue. When attackers can turn a single credential gap into ransomware, the programme question becomes whether identity controls are continuously enforceable across the estate. That pushes IAM, PAM, and NHI governance into the same operational risk conversation as endpoint and network defence.
Discovery has become the limiting factor for identity control coverage. Hybrid estates now span multiple directories, SaaS systems, and non-human accounts, so the biggest risk is often unknown or unverified access rather than deliberately approved access. Teams should assume that any unenforced identity path can become the shortest route to production systems.
Identity blast radius should be the new planning metric. The more critical systems a credential can reach, the more a single enforcement failure can matter. Practitioners need to map which identities can reach regulated data, privileged administration, and high-volume transaction systems, then reduce that blast radius before compromise does it for them.
For practitioners
- Audit MFA enforcement on all remote access entry points Confirm that every Citrix, VPN, SaaS, and privileged access path requires MFA, and document exceptions where legacy systems prevent consistent enforcement.
- Build a complete identity inventory across hybrid estates Correlate Active Directory, cloud directories, SaaS accounts, and machine identities so missing accounts, duplicate accounts, and orphaned access can be found quickly.
- Extend governance to non-human accounts Include service accounts, application accounts, and other machine identities in access reviews, ownership assignment, and lifecycle tracking so they do not become invisible exceptions.
- Prioritise remediation by business-critical access paths Start with identities that can reach regulated data, high-volume transactions, or privileged administration because those accounts create the largest ransomware blast radius.
- Treat identity hygiene as an operational control program Use recurring review cycles to measure enforcement coverage, exception aging, and recovery readiness rather than assuming policy adoption equals real control.
Key takeaways
- The article frames identity hygiene as a practical ransomware problem because compromised credentials can still reach critical systems when MFA is missing or inconsistently enforced.
- The Change Healthcare incident shows that identity gaps can scale into major operational and data exposure events, especially in hybrid environments with legacy access paths.
- Practitioners should treat identity visibility, MFA coverage, and non-human account governance as core control objectives for reducing ransomware blast radius.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Missing MFA on the Citrix portal is the article's clearest control failure. |
| NHI-08 — Environment Isolation | Hybrid estates mix legacy, cloud, and SaaS access paths that create uneven control coverage. | |
| Recommendation — Enforce MFA on every remote access path and remove exceptions that allow password-only entry. Separate access paths by environment so weaker legacy systems cannot inherit the same trust model as higher-risk systems. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on whether access controls are consistently enforced across the identity estate. |
| Recommendation — Apply entitlement governance to verify that only approved identities can reach sensitive systems. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account inventory, ownership, and lifecycle visibility are central to the article's argument. |
| Recommendation — Inventory all accounts, assign ownership, and remove stale or unverified access paths. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The ransomware path began with compromised login credentials lacking MFA. |
| Recommendation — Map credential theft and reuse activity to TA0006 and prioritise detections around valid-account abuse. | ||
Key terms
- Identity hygiene: Identity hygiene is the practice of discovering, normalizing, and enriching identity records so governance can rely on them. It reduces ambiguity across directories, platforms, and operational systems, and it makes access review and remediation possible at enterprise scale.
- Hybrid IAM: Hybrid IAM is an identity operating model that spans on-premises, cloud, SaaS, and containerized environments. It requires consistent policy, auditability, and access lifecycle controls across different control planes, because fragmentation creates exceptions that attackers and auditors both exploit.
- Identity Visibility: Identity visibility is the ability to see which identities exist, what they can access, and how those access paths relate across systems. In NHI programmes, it means correlating service accounts, tokens, certificates, and agents into one operational view so governance decisions are based on evidence, not assumptions.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org