Cyb3rius
@cyb3rius
· Oct 17
Why did one stolen password take down US healthcare billing?The February 2024 Change Healthcare ransomware attack succeeded because a Citrix remote-access portal had no multi-factor authentication, letting attackers pivot into a clearinghouse that touches roughly one in three US medical claims.What happened: On February 21, 2024, UnitedHealth's Change Healthcare unit was hit by ALPHV/BlackCat ransomware, halting pharmacy claims and hospital billing nationwide for weeks. CEO Andrew Witty told Congress the company paid a $22 million ransom to the affiliate, and HHS later confirmed 190 million individuals had data exposed. The 2024 cost to UnitedHealth topped $2.4 billion.Key numbers: 190 million people affected, per HHS Office for Civil Rights$22 million ransom paid in bitcoin$2.4 billion+ in direct response costs for 2024Why it matters: One MFA-less portal at one intermediary froze cash flow for thousands of hospitals and pharmacies, exposing how much of
0