Topic starter
23/06/2026 8:30 pm
TL;DR: Unosecur says the Change Healthcare attack began when stolen credentials were used against a Citrix portal without MFA, then progressed to lateral movement, exfiltration and ransomware that contributed to hundreds of millions in costs. Authentication without identity detection leaves attackers room to move after the first login.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Securing Healthcare Data: Lessons from UnitedHealth Group's Cyberattack and the Role of MFA and Threat Detection”.
Key questions
Q: What breaks when MFA is not enforced on every remote access path?
A: When MFA is inconsistent, a stolen password can still function as a valid enterprise login, which gives attackers a low-friction entry point into critical systems.
Q: Why do stolen credentials and misconfigurations keep leading to major breaches?
A: Stolen credentials and misconfigurations remain effective because they exploit ordinary trust assumptions rather than advanced exploits.
Q: How do teams know whether identity-based detection is working?
A: Look for detections that correlate identity, behaviour, and privilege changes across environments, not just isolated alerts.
Practitioner guidance
- Enforce MFA on all remote access portals Remove password-only access paths for VPN, Citrix, and similar entry points, including exceptions used by vendors or administrators.
- Instrument identity activity for post-login anomalies Monitor login context, unusual API calls, suspicious data retrieval, and changes to security controls so abuse is visible after authentication succeeds.
- Set containment triggers for lateral movement Define when abnormal identity movement, credential reuse, or access to unexpected systems should trigger isolation of the active session and account.
Bottom line: The breach shows that stolen credentials and missing MFA created entry, but post-login monitoring failures determined how far the attack could go.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- The incident timeline from initial portal access through lateral movement, exfiltration, and ransomware.
- The product screenshots and alert examples showing how identity threat detection flags inactive MFA and suspicious behaviour.
- The specific remediation actions the vendor says it would have triggered during the attack path.
- The discussion of how the vendor maps suspicious activity to MITRE ATT&CK techniques.
👉 Read Unosecur's analysis of the Change Healthcare breach and identity detection gap →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:34 am
Authentication is not a containment strategy: The Change Healthcare case shows that MFA can reduce credential replay risk without stopping post-login abuse. Once the attacker is inside, the deciding factor becomes whether the organisation can detect abnormal identity behaviour and contain it before the session turns into data theft or ransomware. For practitioners, that means treating sign-in control and identity detection as separate layers, not substitutes.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What should teams do immediately when a remote access identity behaves unusually?
A: Suspend the session, isolate the account, and check for lateral movement before the attacker can reuse the same identity path elsewhere. The objective is to stop expansion while the compromise is still local, not after it becomes a broader incident.
👉 Read our full editorial: Change Healthcare breach shows why MFA is not enough without identity detection