Change Healthcare: The Attack That Exposed the Data of 190 Million People and What It Reveals About Your Vulnerability

When the Largest U.S. Healthcare Payment Processor Goes Down

In February 2024, the ALPHV/BlackCat ransomware group carried out what would become the most devastating cyberattack ever recorded in the U.S. healthcare sector. The target was Change Healthcare, a UnitedHealth Group subsidiary responsible for processing roughly 15 billion medical transactions per year, including procedure authorizations, payments to hospitals, and medication dispensing at pharmacies nationwide. Within hours, pharmacies could no longer process prescriptions, hospitals lost access to health plan authorizations, and physicians were left without payment confirmations. The chaos lasted for weeks. (Source: BleepingComputer, 2024)

The numbers from the incident are on a scale that is hard to grasp. About 192.7 million people had their personal and medical data exposed, according to the estimate UnitedHealth submitted to the U.S. government in July 2025, making it the largest health data breach in United States history. UnitedHealth Group confirmed it paid a ransom to the criminal group; Reuters reported a payment of about US$ 22 million in bitcoin to a wallet linked to ALPHV, and the company itself disclosed to the market US$ 872 million in negative effects from the attack on its operating income for the first quarter of 2024.

The impact was not limited to the attacked company. Small clinics, independent pharmacies, and mid-sized hospitals reported severe financial hardship as they were unable to collect payment for services rendered. The American Hospital Association described the incident as the cyberattack with the greatest systemic impact ever suffered by the American healthcare sector. A single point of failure, at a single company, was enough to compromise an entire critical supply chain.

The entry vector is public knowledge: in testimony before the U.S. Congress in May 2024, UnitedHealth CEO Andrew Witty stated that on February 12, criminals used compromised credentials to remotely access a Change Healthcare Citrix portal that lacked multi-factor authentication; the ransomware was triggered nine days later. We also know that attacks of this nature and magnitude follow well-documented patterns, and that these patterns repeat across organizations of all sizes, in every industry.

The Vectors That Attacks Like This Typically Exploit

That is what happened at Change Healthcare, and attacks carried out by ransomware groups such as ALPHV/BlackCat often start the same way, with compromised or poorly protected credentials. A single username and password pair obtained from earlier leaks, bought on dark web forums, or captured in a targeted phishing attack can be enough to open the door to an entire environment. When there is no multi-factor authentication (MFA, an additional layer of identity verification) protecting remote access and admin panels, the attacker logs in with legitimate credentials and the system detects nothing out of the ordinary. According to Verizon's 2023 Data Breach Investigations Report, 74% of data breaches involve the human element, including credential misuse.

A second critical vector in attacks of this magnitude is the lack of network segmentation. Network segmentation is the practice of dividing the IT environment into isolated zones, so that a compromise in one segment does not allow unrestricted lateral movement across the entire infrastructure. Without this separation, an attacker who gains access to a peripheral point can move silently for weeks, escalating privileges and mapping critical systems before triggering the ransomware. In IBM's Cost of a Data Breach 2023 report, organizations took an average of 204 days to identify a breach. At Change Healthcare, the ransomware was triggered nine days after the intrusion.

The third common vector in attacks against complex infrastructures is the absence of proactive 24/7 monitoring. Critical environments without continuous monitoring operate essentially in the dark, with no ability to identify anomalous behaviors such as logins at unusual hours, large-scale data exfiltration, or the execution of suspicious scripts. By the time the attack becomes visible, it is already too late. Organizations with active monitoring can detect and contain threats at early stages, before the damage becomes irreversible.

Layered Protection: What You Can Do to Safeguard Your Infrastructure

The first layer of protection every organization must establish is an isolated, encrypted, and regularly tested backup system. An isolated backup means that the backup copies are stored in an environment completely separate from the main network, inaccessible to an attacker who compromises the production systems. Having a backup is not enough: it must be periodically tested with real restoration drills, with documented RTO (Recovery Time Objective, the maximum acceptable time to restore systems) and RPO (Recovery Point Objective, the maximum tolerable data loss threshold), and the team must know exactly what to do when the critical moment arrives. A backup that has never been tested is an assumption, not a guarantee.

The second essential layer is deploying EDR (Endpoint Detection and Response) combined with continuous patch and vulnerability management. EDR monitors each device's behavior in real time, spotting malicious execution patterns even when the code is still unknown to traditional antivirus software. Patch management complements this by ensuring that known vulnerabilities are fixed before they can be exploited. According to IBM's Cost of a Data Breach 2023 report, the average global cost of a data breach, across all attack vectors, was US$ 4.45 million.

The third layer is structural and often overlooked: a documented and tested incident response plan, combined with ongoing user training. According to IBM (2023 report), organizations with an incident response team and regular testing of the plan saved an average of US$ 1.49 million per breach. User training shrinks the social engineering attack surface, while the plan ensures that when the worst happens, every team member knows exactly what their role is, with no decisions made in the heat of the moment under maximum pressure.

Questions Every Decision-Maker Should Be Asking Right Now

1. Would my backups actually work in a disaster like this? How quickly could my operations be back up and running?

2. Does my team have the right tools to identify and block an attack like this immediately, before it causes a full-scale disaster? How am I investing in the preparation of my technical team?

3. How long could my company survive without access to its systems and files?

Would my backups actually work in a disaster like this? How quickly could my operations be back up and running?

This is the question most organizations put off until it is too late. Having backups configured is not the same as having functional backups. A backup that has never undergone a complete, validated restoration is a hypothesis, not a safeguard. In managed IT, recommended practice includes periodic restoration tests in an isolated environment, precise documentation of RTO and RPO for each critical system, and storage of copies in infrastructure that is physically or logically separate from the production network, inaccessible to an attacker who has already compromised the primary environment.

Beyond the backup itself, recovery speed depends on clear processes, pre-configured tools, and a team that has already executed the plan before. Organizations that have never tested their recovery process discover, at the worst possible moment, that the backup exists but the restoration time is three times longer than the business can tolerate. Defining and testing these parameters in advance, with the support of proactive monitoring and a documented response plan, is what separates a recovery measured in hours from a weeks-long outage.

Does my team have the right tools to identify and block an attack like this immediately, before it causes a full-scale disaster? How am I investing in the preparation of my technical team?

Tools and human readiness are inseparable. A high-capability EDR solution operated by an inadequately trained team delivers only a fraction of its potential. Likewise, a well-trained team without real-time endpoint visibility and without 24/7 monitoring operates without the information needed to act before the damage takes hold. Investment in technical readiness must address both dimensions simultaneously and continuously.

Ongoing end-user training is equally critical. Phishing and social engineering still account for the most common entry point in ransomware attacks. A team that knows how to identify a suspicious email, understands the correct procedures when faced with an unusual request, and has a clear channel for reporting incidents is an active layer of defense. Managed IT services that include phishing simulations and periodic training measurably reduce click rates on simulated attacks over time.

How long could my company survive without access to its systems and files?

This question has an objective answer that most decision-makers have never formally calculated. Add up the cost of every hour without operations: halted revenue, unproductive staff, unexecuted contracts, contractual penalties, and reputational damage with clients. Then multiply that by the number of hours it would take to restore systems under the current scenario, without a tested plan. The result is rarely comfortable.

A company's operational survival in the face of a serious incident depends directly on decisions made before the attack. Network segmentation limits the scope of damage. An isolated and tested backup ensures a recovery point. 24/7 monitoring shortens detection time. And a documented incident response plan ensures that the right decisions are made quickly, without improvisation. Each of these capabilities, integrated into a coherent managed IT strategy, is what determines whether an incident becomes a manageable disruption or an existential crisis for the business.

If your company does not yet have an integrated, layered protection strategy in place, consider scheduling a Strategic IT Assessment, at no commitment, to identify vulnerabilities before they become headlines. Speak with a Zamak specialist.