Change Healthcare: one login without two-factor authentication, millions of records exposed

In February 2024, ransomware paralysed Change Healthcare, a central link in US healthcare. A $22m ransom was paid, and about 190 million people were affected.

In February 2024, Change Healthcare, a UnitedHealth subsidiary that processes a large share of US healthcare payments and claims, was hit by ransomware. For weeks, pharmacies and clinics struggled to bill and get paid.

The key facts

• The attack is attributed to an affiliate of the ALPHV group, also known as BlackCat.
• Before the US Congress, UnitedHealth’s CEO confirmed a $22m ransom paid in bitcoin.
• He also acknowledged that initial access came through a remote portal that was not protected by two-factor authentication.
• UnitedHealth later estimated that about 190 million people had their data affected.

Paying does not fix everything

According to press reports, the affiliate behind the attack said it never received its share of the ransom, and some of the data later circulated with a new payment demand. Paying a ransom guarantees neither the deletion of the data nor the end of the incident.

Lessons for any organisation

• Turn on two-factor authentication for every remote access, without exception.
• Find forgotten portals and accounts: they are often the least protected.
• Prepare continuity: how to invoice, take payment or serve customers if the central system goes down.
• Decide your position on ransom demands in advance, with legal advice.

A simple control, a huge impact

Two-factor authentication costs almost nothing to set up. Its absence on a single login contributed to one of the costliest incidents in healthcare history. It is often the most cost-effective measure in cybersecurity.

A single login without two-factor authentication can be enough to bring down a whole system.

Sources: US Congressional hearings (April–May 2024), HHS, TechCrunch, 2024–2025.

Want a better-protected customer area or website admin? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.