Change Healthcare Case Study

Incident sequence

1. 01

   Compromised credentials bypassed control

   On 12 February 2024, the attackers used compromised credentials to remotely access a Change Healthcare Citrix portal used to provide access to desktops. UnitedHealth CEO Andrew Witty later testified that the portal did not have multi-factor authentication. The attackers then moved laterally through the environment and exfiltrated data.

2. 02

   Ransomware triggered nationwide containment

   Nine days after the initial access, ransomware was deployed. UnitedHealth detected the activity on 21 February and disconnected affected Change Healthcare systems from connected environments. The resulting containment removed critical pharmacy, medical claims, payment, eligibility, and related services from normal operation across the U.S. health system.

3. 03

   A technology outage became a health system liquidity crisis

   Hospitals, pharmacies, medical practices, and other providers experienced disrupted claims submission and reimbursement while Change Healthcare services were unavailable. UnitedHealth established temporary funding programs, introduced alternative claims-processing pathways, relaxed some care management requirements, and progressively restored pharmacy, payments, and medical-claims services while providers used manual and alternative workflows.

4. 04

   The incident became a record-scale data breach

   UnitedHealth confirmed that a ransom was paid, with Congressional Research Service reporting the payment at approximately US$22 million in Bitcoin. Change Healthcare later confirmed that stolen information could include contact details, health insurance information, diagnoses and treatment information, billing and claims data, and, for some individuals, Social Security numbers or other identifiers. By July 2025, Change Healthcare had reported approximately 192.7 million affected individuals to HHS.