Cyb3rius
@cyb3rius
· Sep 26
How did the Change Healthcare hack get so big?The attacker logged into a remote-access Citrix portal that had no multifactor authentication, then moved laterally and deployed ransomware across a network that touches a third of U.S. patient records.What happened: On Feb 21, 2024, Change Healthcare, the claims-processing arm of UnitedHealth Group, was hit by ALPHV/BlackCat ransomware. Investigators traced initial access to stolen credentials on a Citrix portal protected by a password alone — CEO Andrew Witty later told Congress MFA was not enabled on that server. The resulting outage froze pharmacy claims and provider payments across the U.S. for weeks.Key numbers: About 190 million people had personal or health data exposed.Roughly $22 million in bitcoin was reportedly paid as ransom.UnitedHealth put the 2024 cost of the attack above $2 billion
0