Change Healthcare runs one of the largest claims clearinghouses in the United States. It moves eligibility checks, prior authorizations and payments between providers and payers, billions of transactions a year.
On February 21, 2024, that plumbing stopped. The ransomware that surfaced that day was the last step of the attack, and the first step had happened nine days earlier, when someone logged into a Citrix remote access portal with a stolen password and nothing asked for a second factor.
As of September 2026, the Change Healthcare cyber attack is still the largest healthcare data breach on record. Change told HHS it affected approximately 192.7 million people.
This teardown walks the chain from the first login to the nationwide outage. For each link, it covers the test that would have caught it.
What CodeAnt AI solves here: CodeAnt AI runs continuous, code-aware penetration testing across your external surface, remote access, APIs and cloud. It proves whether a leaked credential or a missing MFA check actually reaches patient data, with a working proof of exploit for every high or critical finding.
What Happened in the Change Healthcare Cyber Attack
The timeline below comes from UnitedHealth Group's written testimony to the Senate Finance Committee, its answers to follow-up questions, its SEC filings and HHS notices.
Date | What happened |
|---|---|
February 12, 2024 | Attackers log into a Change Healthcare Citrix remote access portal with compromised credentials. The portal has no multi-factor authentication. |
February 12 to 21 | The attackers move laterally and escalate privileges inside the network. |
February 17 to 20 | Protected health information is exfiltrated. |
February 21 | ALPHV/BlackCat ransomware is deployed. UnitedHealth detects the attack and isolates Change systems. |
February 22 | UnitedHealth files an 8-K with the SEC. |
Spring 2024 | UnitedHealth pays a $22 million ransom in bitcoin, later confirmed by its CEO under oath. |
May 1, 2024 | CEO Andrew Witty testifies before the Senate Finance Committee and a House Energy and Commerce subcommittee. |
October 22, 2024 | Change tells HHS about 100 million individual notices have gone out. |
January 24, 2025 | The estimate rises to about 190 million people. |
July 31, 2025 | Change notifies HHS that approximately 192.7 million people were affected. |
Nine days separated the first login from the ransomware. Each of those days was a chance to catch the intrusion.
The Attack Chain, Technically
No single step in this breach required an exploit. Every link used access the environment was already willing to grant.
Stage 1. A credential that already worked
Witty's testimony says the attackers used compromised credentials. UnitedHealth has not said publicly how those credentials were obtained.
Infostealer logs, password reuse from an unrelated breach and phishing are the usual sources. All three hand an attacker a username and password that look identical to a legitimate login.
Stage 2. A remote access portal with no second factor
The Citrix portal let users reach remote desktops from the internet. It is exactly the kind of system an MFA policy is written for. Witty told senators that UnitedHealth's policy required MFA on external-facing systems and that this portal did not have it. He said the company was still working out why.
UnitedHealth had acquired Change about a year and a half before the attack. Witty said the company was still bringing Change's protections up to its own standards when the attackers arrived. A remote access gateway without MFA turns a password into a desktop inside the network. For the attacker, stages one and two took a single login.
Stage 3. Nine days of lateral movement
Once inside, the attackers moved laterally and escalated privileges. Witty's testimony describes that movement as sophisticated. Detection is the gap at this stage. A new remote session followed by privileged activity across servers is the pattern monitoring exists to flag, and it ran for more than a week.
Stage 4. Exfiltration before encryption
Between February 17 and 20, the attackers pulled protected health information out of Change's systems. No ransomware had run yet. That order matters for defenders. By the time encryption announces an attack, the data has usually left, so restoring from backups brings systems back and does nothing for the stolen records.
Stage 5. Ransomware on a shared chokepoint
On February 21, the ransomware ran and UnitedHealth took Change systems offline. Because Change sat between so many providers and payers, the outage spread far past one company. Practices could not file claims or get paid. Pharmacies struggled to process prescriptions, and hospitals burned through cash reserves while claims sat unprocessed.
Why One Portal Took Down Claims Nationwide
Change processes billions of insurance claims a year. When a node that central goes dark, every organization routing through it goes dark too. UnitedHealth's 2024 annual report puts numbers on the fallout.
Impact | Figure | Source |
|---|---|---|
Direct response costs in 2024 | $2.2 billion | UnitedHealth 10-K |
Business disruption at Optum Insight in 2024 | $867 million | UnitedHealth 10-K |
Interest-free loans advanced to providers | More than $9 billion | UnitedHealth 10-K |
Ransom paid | $22 million | CEO testimony |
People affected | About 192.7 million |
The ransom ended up as the smallest number in that table. The larger costs came from being the system everyone else depended on.
Why MFA Was Missing on a Critical Portal
A written MFA policy covers the systems someone remembered to list. Acquisitions, legacy gateways, vendor exceptions and test servers that quietly became production all fall outside it.
This is the same valid-login pattern described in our guide to how healthcare and biotech platforms get breached. The policy was sound, and the inventory it depended on was incomplete. Closing that gap takes verification from the outside. Every internet-facing login needs to be found, tested for MFA enforcement and re-checked whenever the environment changes.
What a Real Test Against This Chain Looks Like
A test that mirrors this attack starts where the attacker started, outside the network with a credential. Each link in the chain maps to a specific check.
Chain link | What the test checks | Evidence it produces |
|---|---|---|
Leaked credential | Company accounts circulating in breach dumps and infostealer logs | A list of exposed accounts, flagged if still valid |
Internet-facing remote access | Every VPN, Citrix, RDP and SSO login the internet can reach, and whether MFA is actually enforced on each | Per-endpoint proof that MFA is or is not enforced |
Post-login reach | What a single authenticated identity can touch in apps, APIs and cloud | A proven path from the foothold toward PHI stores |
Data access | Whether that identity can query or export patient data in bulk | Records reachable, with sample evidence |
Detection | Whether monitoring flagged the test activity, and how fast | Time to detect for each stage |
Our breakdown of black box, white box and gray box testing covers how outside-in and assumed-breach testing fit together.
Lateral movement across on-premise servers and domain controllers is usually scoped as an internal network test. Run it alongside application and cloud testing so no part of the chain goes untested.
Lessons for Health-Tech, Payer and Clearinghouse Teams
The Change Healthcare cyber attack produced a short list of lessons that apply well beyond one company.
Verify MFA from the outside: Policy documents describe intent. Only an external test proves which login pages actually demand a second factor.
Treat every acquisition as new attack surface: Inventory and test an acquired company's internet-facing systems before its network is trusted by yours.
Assume exfiltration comes first: Plan incident response around stolen data, since ransomware often arrives after the data has already left.
Watch remote access sessions closely: A first-time login followed by privileged activity should page someone within hours.
Plan for your dependencies failing: If a clearinghouse or vendor sits on your revenue path, test the fallback before you need it.
Keep the evidence: Test results feed directly into the HIPAA risk analysis OCR asks for first.
The Regulatory Fallout
HHS's Office for Civil Rights opened an investigation in March 2024, before Change had even filed its breach report. Nebraska's attorney general also sued Change, and that case survived a motion to dismiss in late 2025.
The attack also sharpened the push to update the HIPAA Security Rule. The proposed rule would make MFA mandatory for systems that access ePHI, and as of September 2026 its final action is targeted for July 2027. Our HIPAA compliance checklist tracks where that rule stands. The existing rule already expects a risk analysis that would have listed this portal.
How CodeAnt Would Have Caught This
The exact credential used and the internal path the attackers took are not public. So we can't claim CodeAnt would have stopped this specific breach.
What we can say is that the first two links in this chain, a leaked credential and an internet-facing login without MFA, are exactly what CodeAnt's testing is built to find.
Continuous external mapping: Attack surface management maps every domain, IP, open port and exposed service from more than thirty data sources, including certificate transparency and passive DNS. A remote access portal nobody listed still shows up.
Leaked credential discovery: Reconnaissance surfaces company credentials already circulating on the open internet, before an attacker uses them.
Proof instead of a flag: Gray box agents authenticate as a compromised identity and chain what it can reach toward patient data, with a working proof of exploit for each high or critical finding.
Testing that tracks change: Testing runs as the environment changes, so a gateway inherited through an acquisition gets tested when it appears instead of at next year's engagement.
The walkthrough of how AI penetration testing traces a data leak shows a full chain end to end.
The Fix
The Change Healthcare cyber attack did not need a zero-day. It needed one password and one login page that never asked for anything else. Find every login the internet can reach, prove each one enforces MFA, and test what a stolen session can touch after it gets in.
Run a free black box scan on one URL to see your exposed surface the way an attacker maps it. For the compliance side, start with our guide to HIPAA penetration testing requirements.
