In February 2024, attackers logged in to a Change Healthcare remote-access portal using a stolen employee credential. The portal did not require multi-factor authentication. Nine days later they deployed ransomware, taking down the claims and payments processing that much of the US healthcare system relies on. UnitedHealth Group, Change Healthcare's parent, paid a $22 million ransom, and by August 2025 it had put the number of people affected at 192.7 million, the largest healthcare data breach reported in the United States. Change Healthcare is a human identity breach rather than a non-human identity one, but it shows what a single unprotected credential on a remote-access gateway can cost.
Key takeaways
- Initial access on 12 February 2024 came through a Citrix remote-access portal using compromised credentials. UnitedHealth's CEO told Congress: "The portal did not have multifactor authentication."
- Attackers moved laterally and stole data for nine days before deploying ALPHV/BlackCat ransomware on 21 February 2024.
- UnitedHealth paid a $22 million ransom. The data later resurfaced with a second group, RansomHub, which demanded another payment; UnitedHealth says no second payment was made.
- The affected population grew from early estimates to 192.7 million people in UnitedHealth's August 2025 update, and 2024 cyberattack costs were projected at $2.87 billion.
- The core failures are identity basics: MFA on every external access point, detection of stolen-credential logins, and limits on how far one account can reach once inside.
At a glance
| Organisation | Change Healthcare, part of UnitedHealth Group (Optum) |
|---|---|
| When | Initial access 12 February 2024; ransomware deployed 21 February 2024 |
| Attacker | ALPHV/BlackCat ransomware affiliate; data later held by RansomHub |
| Entry point | Citrix remote-access portal without multi-factor authentication |
| Identities abused | A compromised employee (human) credential for remote desktop access |
| Impact | 192.7 million people affected (UnitedHealth, August 2025); nationwide claims and pharmacy disruption; $22 million ransom; 2024 costs projected at $2.87 billion |
| Category | Human identity (not listed as an NHI or AI agent breach) |
What happened
Change Healthcare processes medical claims, pharmacy transactions and payments for a large share of the US healthcare system. On 12 February 2024, attackers used compromised credentials to log in to one of its Citrix portals, an application used for remote access to desktops. In written testimony to the House Energy and Commerce Committee, UnitedHealth Group CEO Andrew Witty said: "The portal did not have multifactor authentication."
Once inside, Witty testified, "they moved laterally within the systems in more sophisticated ways and exfiltrated data. Ransomware was deployed nine days later", on 21 February 2024. Change Healthcare disconnected its systems to contain the attack. Pharmacies, hospitals and physician practices across the country lost the ability to submit claims and check coverage, and many faced serious cash-flow problems for weeks.
The ALPHV/BlackCat ransomware group claimed the attack. UnitedHealth paid a $22 million ransom. Witty told lawmakers: "The decision to pay a ransom was mine. This was one of the hardest decisions I've ever had to make." Shortly afterwards BlackCat shut down in what was widely reported as an exit scam, and the affiliate behind the attack moved the stolen data to another group, RansomHub, which demanded a further payment. UnitedHealth says no second payment was made.
How the credential was stolen has not been confirmed publicly. Witty said the company did not know whether it came from phishing or malware. Hudson Rock, an infostealer intelligence firm, reported that a Change Healthcare employee's device was infected with infostealer malware on 7 February 2024, days before the intrusion, while noting that "it is not certain that these are the specific credentials used for the attack".
Timeline
| Date | Event |
|---|---|
| 7 February 2024 | An employee device is infected with infostealer malware, according to Hudson Rock (not confirmed as the source of the credential). |
| 12 February 2024 | Attackers log in to a Citrix remote-access portal with compromised credentials; no MFA. |
| 12 to 21 February 2024 | Lateral movement and data exfiltration. |
| 21 February 2024 | Ransomware deployed; Change Healthcare disconnects affected systems. |
| February to April 2024 | $22 million ransom paid; BlackCat shuts down; RansomHub later demands a second payment, which UnitedHealth says it did not make. |
| 1 May 2024 | Andrew Witty testifies before the House Energy and Commerce oversight subcommittee. |
| October 2024 | UnitedHealth projects 2024 cyberattack costs of $2.87 billion. |
| December 2024 | Nebraska's Attorney General files the first state lawsuit over the breach. |
| 6 August 2025 | UnitedHealth updates the affected count to 192.7 million people. |
How it happened: the identity attack path
- Credential exposure. An employee's remote-access credential fell into attacker hands. The route is unconfirmed; infostealer malware on a personal or work device is one reported possibility.
- Single-factor remote access. The Citrix portal accepted the username and password alone. With no second factor, a stolen password was all the attackers needed.
- No challenge to an unusual login. Nothing reported suggests the login was flagged as unusual, for example by device, location or behaviour, before the attackers were inside.
- Lateral movement. From the remote desktop, the attackers moved across Change Healthcare's environment for nine days. Public reporting does not detail which accounts and privileges they used, but reaching enough systems to exfiltrate data at this scale and deploy ransomware widely requires broad access.
- Exfiltration and encryption. Large volumes of health and personal data were copied out before the ransomware ran, setting up double extortion.
Impact
- People affected: 192.7 million, per UnitedHealth's August 2025 update, which Change Healthcare described as its final estimate. It is the largest breach of health data ever reported in the United States.
- Healthcare operations: claims, eligibility checks and pharmacy payments were disrupted across the country for weeks.
- Financial: a $22 million ransom, and cyberattack impacts that UnitedHealth projected at $2.87 billion for 2024.
- Legal and regulatory: an HHS Office for Civil Rights investigation, a consolidated class action in Minnesota, and a lawsuit by Nebraska's Attorney General that survived a motion to dismiss in November 2025.
What this means for identity security
Change Healthcare is on our list because it is one of the clearest examples of identity as the perimeter. The attackers did not need an exploit. They needed one working login to an internet-facing remote-access service, and the controls that should have stopped a stolen password there were missing.
Three lessons carry across to non-human identities. First, every externally reachable access path needs strong authentication, and the one that is forgotten is usually the one used. The same logic applies to API endpoints and service accounts that accept a static key with nothing else. Second, credentials stolen by infostealers are a supply of ready-made access for ransomware crews. That is true for passwords, session cookies and the API keys and tokens found on the same developer machines. Third, what an attacker can do after login depends on how far one identity can reach. Segmentation and least privilege turn a single compromised account into a contained incident rather than a national outage.
The incident also shows how concentrated risk has become. When a clearing house that sits between thousands of providers and payers goes down, the harm reaches far beyond the company that was breached. The same concentration exists in machine-to-machine integrations, where one compromised connector or token can expose many downstream organisations, as the Salesloft Drift OAuth token breach showed.
Recommendations
- Enforce phishing-resistant MFA on every remote-access service, including legacy Citrix, VPN and remote desktop gateways, and audit regularly for exceptions. See our Workforce Identity Security Guide.
- Watch for infostealer exposure. Monitor for your organisation's credentials and session tokens in infostealer logs, and reset affected accounts and tokens straight away.
- Protect managed and unmanaged devices. Restrict remote access to compliant devices so that a credential stolen from a personal machine cannot be used on its own.
- Limit blast radius. Segment remote-access users from core production systems and apply least privilege, with privileged access brokered and time-bound. Our Privileged Access Management Guide covers this.
- Detect lateral movement early. Nine days passed between access and ransomware. Alert on new remote logins followed by credential use across many hosts.
- Apply the same rules to machine identities. API keys and service accounts on externally reachable services should never be the only barrier. Use short-lived, scoped credentials, as described in our NHI Authentication Guide.
Frequently asked questions
How did attackers get into Change Healthcare?
They used compromised credentials to log in to a Citrix remote-access portal on 12 February 2024. UnitedHealth's CEO testified that the portal did not have multi-factor authentication.
How many people were affected by the Change Healthcare breach?
UnitedHealth updated the figure to 192.7 million people in August 2025, which Change Healthcare described as its final estimate.
Is Change Healthcare a non-human identity breach?
No. The entry point was a human employee credential. We cover it because it shows the cost of a single unprotected login on a remote-access service, a weakness that machine identities share when they rely on a static secret alone.
Related NHI Mgmt Group resources
Snowflake breach · Salesloft Drift OAuth token breach · Human vs Non-Human Identity · IAM and IGA Basics
How NHI Mgmt Group can help
Attackers target whichever identity is least protected, human or machine. Our NHI Foundation Level Training Course helps teams extend the identity controls they apply to people, such as strong authentication, least privilege and monitoring, to service accounts, API keys, tokens and AI agents.
References
- Healthcare Dive: Change Healthcare, compromised by stolen credentials, did not have MFA turned on (30 April 2024), reporting Andrew Witty's written testimony to the House Energy and Commerce Committee
- BleepingComputer: Change Healthcare hacked using stolen Citrix account with no MFA (30 April 2024)
- TechTarget: Change Healthcare breached via Citrix portal with no MFA
- Hudson Rock (Infostealers.com): Single Citrix compromised credential results in $22,000,000 ransom to Change Healthcare (1 May 2024)
- HIPAA Journal: Change Healthcare cyberattack coverage, including the 192.7 million update and cost figures
