ClosedCriticalNo fix needed
Day · Feb 12, 2024
Change Healthcare ransomware attack (ALPHV/BlackCat)
Change Healthcare (UnitedHealth Group / Optum)
Updates on Feb 12, 2024
Attackers access a Change Healthcare Citrix portal with stolen credentials (no MFA), per CEO testimony
Source
Summary
The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).
Read the full incident →
