Change Healthcare ransomware attack (ALPHV/BlackCat)
Change Healthcare (UnitedHealth Group / Optum)
The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).
Why this severity: Ransomware, nationwide healthcare outage, largest US healthcare breach
- Started
- Feb 21, 2024
- Closed
- Oct 22, 2024
Affected
Not published yet
Fixed in
No fixed release yet
Updates by day6
▸Oct 22, 2024
Link #Change Healthcare tells HHS OCR it has sent about 100 million individual notices
Source
▸May 1, 2024
Link #CEO Andrew Witty testifies before the Senate Finance Committee
Source
▸Apr 22, 2024
Link #UnitedHealth: stolen files could cover a substantial proportion of people in America
Source
▸Feb 22, 2024
Link #UnitedHealth files an SEC 8-K on the cybersecurity incident
Source
▸Feb 21, 2024
Link #Ransomware deployed; Change Healthcare systems disconnected
Source
▸Feb 12, 2024
Link #Attackers access a Change Healthcare Citrix portal with stolen credentials (no MFA), per CEO testimony
Source
Advisories2
News & write-ups3
Get an email when a new major security incident drops. No spam, unsubscribe any time.
