Article
Ransomware examples: attacks, types and groups
Ransomware examples explained: five documented attacks, the main types of ransomware and the groups named in recent government advisories.
Read more
Significant cyber incident
Change Healthcare ransomware attack (February 2024)
The Change Healthcare ransomware attack of February 2024 hit a UnitedHealth Group company that moves claims and payments between providers, pharmacies and health plans.
In short
The Change Healthcare ransomware attack of February 2024 hit a UnitedHealth Group company that moves claims and payments between providers, pharmacies and health plans. The CEO told Congress that criminals used stolen credentials on a remote access portal without multi-factor authentication, took data, and deployed ransomware nine days later. Pharmacies, claims and payments were disrupted, and the federal government opened emergency Medicare payment programs.
What happened
On the morning of 21 February 2024, a criminal calling itself ALPHV or BlackCat deployed ransomware inside the IT environments of Change Healthcare. UnitedHealth Group CEO Andrew Witty told a House subcommittee that the ransomware encrypted Change’s systems so the company could not access them. Change Healthcare is part of Optum and moves information, claims and payments between physicians, pharmacists, health plans and governments.
The company did not know the entry point at first. It cut connectivity to Change’s data centers at once. The CEO said there has never been evidence that the attack spread beyond Change to other UnitedHealth Group units.
The CEO said the intruders had entered nine days earlier, on 12 February, using compromised credentials on a Citrix remote access portal that had no multi-factor authentication. They moved inside the network and took data before the ransomware was launched. The CEO also said that the decision to pay a ransom was his. This page names Change Healthcare because the incident had national impact on pharmacies, claims and payments.
Timeline
-
Early December 2023
Operational action against ALPHV Blackcat and its infrastructure; the advisory says its administrator then urged affiliates to target hospitals.
-
12 February 2024
Criminals use compromised credentials to reach a Change Healthcare Citrix portal that had no multi-factor authentication.
-
21 February 2024
ALPHV or BlackCat deploys ransomware; the company severs connectivity to Change's data centers and contacts the FBI within hours.
-
21 February 2024 (afternoon)
Outside incident response experts head to Change's Nashville operations center to start rebuilding.
-
27 February 2024
FBI, CISA and HHS update advisory AA23-353A on ALPHV Blackcat.
-
1 March 2024
Optum launches a Temporary Funding Assistance Program for affected providers.
-
6 March 2024
CMS says it is concerned about small practices and community-based providers.
-
7 March 2024
99% of pre-incident pharmacies can process claims; UnitedHealth Group publishes a restoration timeline.
-
9 March 2024
CMS makes accelerated and advance Medicare payments available (CHOPD).
-
15 March 2024
Change Healthcare's electronic payments platform is restored.
-
18 March 2024
Medical claims preparation software starts to be released; over 2 billion dollars advanced to providers so far.
-
22 April 2024
UnitedHealth Group says data files could cover a substantial proportion of people in America; about 80% of functionality restored.
-
1 May 2024
The CEO testifies before the House Energy and Commerce Oversight and Investigations Subcommittee.
-
12 July 2024
CMS closes the CHOPD payment program to new applications.
How the attack worked
Getting in
The CEO told Congress that on 12 February 2024 criminals used compromised credentials to remotely access a Change Healthcare Citrix portal, an application used for remote access to desktops. The portal did not have multi-factor authentication. The sources opened do not say how the credentials were obtained.
Moving and taking data
According to the CEO, once inside the intruders moved laterally within the systems and exfiltrated data. Ransomware was deployed nine days after the first access, on 21 February.
How the ALPHV Blackcat group usually works
The joint FBI, CISA and HHS advisory AA23-353A (updated 27 February 2024) describes the group as ransomware as a service run through affiliates. This is general behavior of the group, not a finding about this case. Affiliates pose as IT or helpdesk staff to get credentials (Phishing for Information, T1598), use compromised accounts (Compromise Accounts, T1586), obtain passwords from domain controllers, local networks and deleted backup servers (T1555), and use Kerberos tickets for domain access (Steal or Forge Kerberos Tickets, T1558). They also use Evilginx2 to capture MFA credentials and session cookies (Adversary-in-the-Middle, T1557). Some affiliates steal data and extort victims without deploying ransomware.
The advisory does not link these steps to Change Healthcare. No public attribution of the entry method beyond the CEO’s account was found in the sources opened.
- Stolen loginCompromised credentials used on a Citrix remote access portal, 12 February
- No MFAThe portal had no multi-factor authentication
- Inside the networkLateral movement and data taken
- RansomwareALPHV or BlackCat ransomware deployed, 21 February
- ShutdownCompany cut links to Change data centers to stop spread
ATT&CK techniques
Who says who was behind it
Who attributed it, and how firm it is
UnitedHealth Group CEO Andrew Witty, 1 May 2024 (written testimony to a House subcommittee): the ransomware was deployed by a cybercriminal calling themselves ALPHV or BlackCat. This is the company's account.
FBI, CISA and HHS, 27 February 2024 (advisory AA23-353A update): describe ALPHV Blackcat as a ransomware as a service operation and say healthcare has been the most commonly victimized sector since mid-December 2023. The advisory text opened does not name Change Healthcare.
No government attribution to a state was found in the sources opened.
Malware and vulnerabilities used
Impact
Pharmacies: UnitedHealth Group said 99% of pre-incident pharmacies could process claims by 7 March 2024 (CEO testimony, 1 May 2024). The CEO described pharmacists having to submit claims by hand.
Payments: Change Healthcare payment processing is about 6% of all payments. It was at about 86% of pre-incident levels on 22 April and 1 May 2024.
Providers: CMS said the attack affected health care operations across the country and voiced concern for small practices and community providers (CMS, 6 and 9 March 2024). The CEO cited rural practices struggling to make payroll.
Funding: UnitedHealth Group said it advanced more than 6.5 billion dollars in accelerated payments and loans by 26 April 2024. CMS issued more than 2.55 billion dollars to over 4,200 Part A providers and more than 717.18 million dollars in 4,722 advance payments to Part B suppliers (CMS, 17 June 2024).
Data: on 22 April 2024 the company said files with health or personal data could cover a substantial proportion of people in America. It had not seen evidence that doctors' charts or full medical histories were taken, and 22 screenshots were posted on the dark web for about a week. The company said this was not an official breach notification.
Whether a ransom was paid: the CEO said the decision to pay was his; the amount is not stated in the sources opened. Total cost and final number of affected people were not stated in the sources opened.
Government and regulator response
- 21 February 2024: UnitedHealth Group cut connectivity to Change’s data centers, contacted the FBI within hours and brought in outside incident response experts (CEO testimony).
- 27 February 2024: FBI, CISA and HHS updated advisory AA23-353A with indicators and techniques of ALPHV Blackcat.
- 1 to 18 March 2024: Optum launched a Temporary Funding Assistance Program; the company suspended some prior authorizations in Medicare Advantage; pharmacy services, payments and claims software were restored in stages (UnitedHealth Group, 7 and 18 March).
- 6 and 9 March 2024: CMS said it would press the company for better interim payment options and opened accelerated and advance Medicare payments of up to thirty days of claims, repaid by recoupment over 90 days.
- 22 April 2024: UnitedHealth Group offered two years of credit monitoring and identity protection, a clinician-staffed call center, and to send notices for providers and customers.
- 1 May 2024: The CEO testified to the House Energy and Commerce Oversight and Investigations Subcommittee and said the company supports mandatory minimum security standards and standard national event reporting.
- 17 June 2024: CMS said the payment program would close on 12 July 2024 and that over 96% of the payments had been recovered.
HHS Office for Civil Rights notices and the Senate Finance Committee hearing were not opened for this page, because those sites could not be read by the checking tool.
Lessons
-
Remote access without MFA is a front door
The CEO said the Citrix portal had no multi-factor authentication. CISA tells organizations to enable and enforce MFA.
-
One supplier can stall a whole sector
Change Healthcare handles about 6% of all payments. Pharmacies, claims and payments across the country were disrupted.
-
Cutting links early limits spread
The company severed connectivity to Change's data centers at once, and says the attack never spread beyond Change.
-
Have a plan for cash flow
CMS and UnitedHealth Group both had to open emergency payment programs because providers could not receive payments.
-
Rebuild takes weeks even with help
Systems were rebuilt from the ground up, with thousands of laptops replaced and credentials rotated, and restoration ran for weeks.
-
Data review takes months
After weeks the company still could not say whose data was involved, which delays notices to affected people.
What to check in your own organization
-
Remote access portals
List every portal that gives remote desktop or application access and confirm each one requires multi-factor authentication.
-
Stolen credentials
Check whether staff or contractor logins appear in leaks, and force resets and session revocation when they do.
-
Helpdesk verification
Confirm the helpdesk checks identity before resetting passwords or MFA, since affiliates pose as IT staff by phone and text.
-
Supplier dependency
Map which clearing houses, billing and payment suppliers you rely on and what you do if one is offline for weeks.
-
Network isolation
Test whether you can cut links to a data center or supplier quickly, and who can decide to do it.
-
Backup and password stores
Check that backups and password stores cannot be reached with ordinary admin logins.
-
Contacts and reporting
Keep contact details for the FBI, CISA and your regulators ready, and agree who reports and when.
Where it happened
- Industry Healthcare and pharma Ransomware, stolen staff logins, patient data on leak sites and supplier exposure at hospitals and drug makers, and the rules that apply.
- Country United States This page collects what matters for cyber threats in the United States: the sectors attackers go after, the threat groups that US government sources link to the country, the major national incidents, and the bodies and rules to know. North America
Questions
Who carried out the Change Healthcare attack?
UnitedHealth Group's CEO told Congress that a cybercriminal calling themselves ALPHV or BlackCat deployed the ransomware. No state attribution appears in the sources opened.
How did the attackers get in?
The CEO said they used compromised credentials on a Change Healthcare Citrix remote access portal on 12 February 2024. The portal had no multi-factor authentication.
Was customer health data taken?
The company said data sampling found files with health or personal data that could cover a substantial proportion of people in America. It had not seen evidence that doctors' charts or full medical histories were taken.
Did the company pay a ransom?
The CEO said the decision to pay a ransom was his. The sources opened do not state the amount.
How did the government help providers?
CMS opened accelerated and advance Medicare payments from 9 March 2024. It issued more than 2.55 billion dollars to over 4,200 Part A providers and more than 717.18 million dollars to Part B suppliers.
Did the attack spread to other UnitedHealth Group units?
The CEO said there has never been evidence of spread beyond Change Healthcare.
In our research
- Ransomware examples: attacks, types and groups October 2026
Sources
- Testimony of Andrew Witty, "Examining the Change Healthcare Cyberattack", 1 May 2024 U.S. House Committee on Energy and Commerce
- UnitedHealth Group Update on Change Healthcare Cyberattack, 7 March 2024 UnitedHealth Group
- UnitedHealth Group Cyberattack Status Update, 18 March 2024 UnitedHealth Group
- UnitedHealth Group Updates on Change Healthcare Cyberattack, 22 April 2024 UnitedHealth Group
- CMS Statement on Change Healthcare Cyberattack, 6 March 2024 Centers for Medicare & Medicaid Services
- Change Healthcare/Optum Payment Disruption (CHOPD) Accelerated Payments to Part A Providers and Advance Payments to Part B Suppliers Centers for Medicare & Medicaid Services
- CMS Preparing to Close Program that Addressed Medicare Funding Issues Resulting from Change Healthcare Cyber-Attack, 17 June 2024 Centers for Medicare & Medicaid Services
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.