# Change Healthcare ransomware attack (ALPHV/BlackCat) · pwn.watch

> The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).

Page: https://pwn.watch/i/change-healthcare-ransomware-attack · generated 2026-10-22T21:04:29.518Z

## Status
- Severity: critical · status: closed · patch: no-fix-needed
- Product: Change Healthcare (UnitedHealth Group / Optum)
- Started: 2024-02-21 · closed: 2024-10-22

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/change-healthcare-ransomware-attack/feed.xml
- JSON Feed: https://pwn.watch/i/change-healthcare-ransomware-attack/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/change-healthcare-ransomware-attack.json
- This file: https://pwn.watch/i/change-healthcare-ransomware-attack/llms.txt

## Updates (newest first)
- 2024-10-22: Change Healthcare tells HHS OCR it has sent about 100 million individual notices (https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html)
- 2024-05-01: CEO Andrew Witty testifies before the Senate Finance Committee (https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf)
- 2024-04-22: UnitedHealth: stolen files could cover a substantial proportion of people in America (https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html)
- 2024-02-22: UnitedHealth files an SEC 8-K on the cybersecurity incident (https://www.sec.gov/Archives/edgar/data/731766/000073176624000085/unh-20240221.htm)
- 2024-02-21: Ransomware deployed; Change Healthcare systems disconnected (https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf)
- 2024-02-12: Attackers access a Change Healthcare Citrix portal with stolen credentials (no MFA), per CEO testimony (https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf)

## Fix brief
# Security brief: Change Healthcare ransomware attack (ALPHV/BlackCat)

Source: https://pwn.watch/i/change-healthcare-ransomware-attack · status: closed (closed Oct 22, 2024) · severity: critical · updated Oct 22, 2024

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).

Severity detail: Ransomware, nationwide healthcare outage, largest US healthcare breach

- Product: Change Healthcare (UnitedHealth Group / Optum)

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Oct 22, 2024: Change Healthcare tells HHS OCR it has sent about 100 million individual notices
- May 1, 2024: CEO Andrew Witty testifies before the Senate Finance Committee
- Apr 22, 2024: UnitedHealth: stolen files could cover a substantial proportion of people in America
- Feb 22, 2024: UnitedHealth files an SEC 8-K on the cybersecurity incident
- Feb 21, 2024: Ransomware deployed; Change Healthcare systems disconnected
- Feb 12, 2024: Attackers access a Change Healthcare Citrix portal with stolen credentials (no MFA), per CEO testimony

## Advisories
- [UnitedHealth Group updates on Change Healthcare cyberattack](https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html) (UnitedHealth Group)
- [Change Healthcare cybersecurity incident FAQ](https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html) (HHS OCR)

## Write-ups & news
- [Testimony of Andrew Witty before the Senate Finance Committee](https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf)
- [UnitedHealth Group Form 8-K/A (Item 1.05)](https://www.sec.gov/Archives/edgar/data/731766/000073176624000085/unh-20240221.htm)
- [UnitedHealth says hackers potentially stole a third of Americans' data](https://www.reuters.com/world/us/unitedhealth-ceo-testifies-before-us-senate-house-hack-2024-05-01/)

---
Machine-readable: https://pwn.watch/i/change-healthcare-ransomware-attack.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.