Cyb3rius
@cyb3rius
· Sep 18
Why did the Change Healthcare hack affect 190 million people?The Change Healthcare ransomware attack became the largest healthcare data breach in U.S. history, exposing the personal and medical data of roughly 190 million Americans. It started with a single stolen credential and no multi-factor authentication.What happened: On February 12, 2024, attackers used compromised credentials to log into a Change Healthcare Citrix remote access portal that lacked MFA. The ALPHV/BlackCat ransomware gang deployed ransomware days later, crippling claims processing nationwide for weeks. UnitedHealth Group paid a $22 million ransom in March 2024, and later confirmed the breach exposed data on about 190 million individuals.Key numbers: 190 million people affected, per UnitedHealth's January 2025 update$22 million ransom paid in Bitcoin in March 2024Prescription and claims processing disrupted for weeks, hitting pharmacies and hospitals across all 50 statesWhy it matters: One missing MFA control at a single intermediary froze payments for a huge share of U.S. healthcare, showing how concentrated third-party vendors create systemic risk.Bottom line: A password and an unpatched login portal took down a third of American healthcare billing.
0