CyphrQ
Menu

Change Healthcare Ransomware Attack 2024: Facts, Costs, OCR Role

The 2024 Change Healthcare ransomware attack: what happened, people affected, UnitedHealth's disclosed costs, and what is known of HHS OCR's response.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Incident: February 20249 min read

What was the Change Healthcare ransomware attack? On 21 February 2024, UnitedHealth Group identified that criminals had gained access to systems of its subsidiary Change Healthcare, whose services include pharmacy claims and payment processing. The company's annual filing puts the people affected at about 190 million. Its 2024 direct response costs were $2.2 billion.

This is a case file for the North America breaches section. It separates what the company and the Senate hearing record say from what we could not verify. One gap matters up front: HHS's Office for Civil Rights (OCR) pages refused our tools (HTTP 403), so this post makes no claim about OCR's findings.

Case file

Field Value
Organisation Change Healthcare, part of Optum, a UnitedHealth Group (UHG) business
Region United States
Breach date UHG "identified" the intrusion on 21 February 2024 (UHG 10-K). The CEO told the Senate the attackers "entered probably 9 days before" ransomware was deployed (hearing record)
Disclosed UHG's 22 April 2024 release says it had found files containing health and personal information (UHG)
People affected "Approximately 190 million" in UHG's FY2024 10-K (SEC). A later figure of about 192.7 million was reported by Business Insurance; we could not read the HHS page it cites
Data types Files with "protected health information (PHI) or personally identifiable information (PII)". UHG said it had not seen evidence that doctors' charts or full medical histories were taken (as of April 2024)
Penalty/action None found in sources we could read. OCR opened an investigation; we could not open OCR's pages to confirm its scope or status
Regulator HHS Office for Civil Rights (OCR)
Status Not verified. UHG's 10-K says the final count "will be confirmed and filed with the Office for Civil Rights"

When did the Change Healthcare ransomware attack happen?

UHG's 10-K states that on 21 February 2024 the company "identified that cybercrime threat actors had gained access to certain Change Healthcare information technology systems" (SEC). The filing does not say when the intrusion began.

Andrew Witty, then UHG's CEO, told the Senate Finance Committee that attackers deployed ransomware on 21 February. Asked by Sen. Johnson about the timeline, he said they "entered probably 9 days before" (hearing record). Ransomware is malware that locks a victim's systems until it pays. Here it also came with stolen data.

By 22 April 2024, UHG said pharmacy services were "back to near-normal levels, with 99% of pre-incident pharmacies able to process claims". Payment processing was at about 86% of pre-incident levels, and about 80% of Change functionality on major platforms had been restored (UHG). The same release said 22 screenshots, allegedly from stolen files, had been posted on the dark web for about a week.

Neither the 10-K nor the hearing text we read names the ransomware group. We leave it out rather than rely on press.

Did UnitedHealth pay the Change Healthcare ransom?

Yes, according to its CEO's Senate testimony. Witty said: "The decision to pay a ransom was mine." Asked by Sen. Cortez Masto how much was paid, he answered: "Twenty-two million dollars" (hearing record). We did not find the amount in UHG's filings. It rests on this one exchange in the record.

How did the attackers get into Change Healthcare?

The public account is thin, and it comes from the hearing. Witty said in his opening statement: "The portal they accessed was not protected by multifactor authentication." Multifactor authentication (MFA) means proving who you are in two or more ways, such as a password plus a code from your phone. In answer to Sen. Johnson he described a server that "was not protected by MFA" (hearing record).

That is everything we can say with a primary source. The portal's product name, how the credentials were obtained and the exact first-access date are not in the pages we read. We don't repeat them from press.

How many people did the Change Healthcare breach affect?

Source Figure What it is
UHG FY2024 10-K "Approximately 190 million" Company estimate; says the final count "will be confirmed and filed with the Office for Civil Rights" (SEC)
Business Insurance 192.7 million Press report of a figure on a US government site; we could not open that page (Business Insurance)
Senate hearing, Sen. Wyden At least 211 million A 2022 figure for records Change "retains", not victims of the attack (hearing record)

The three numbers measure different things. Use 190 million as the company's own estimate, and treat 192.7 million as a press-reported figure until you have checked OCR's page yourself.

At the hearing, Witty said the exfiltrated files "could cover a substantial proportion of people in America." No exact count was given then.

What did the Change Healthcare attack cost UnitedHealth?

All figures below are from UHG's FY2024 10-K (SEC), for the year ended 31 December 2024.

Item Amount Wording in the filing
Direct response costs $2.2 billion "incurred $2.2 billion of direct response costs, including costs associated with providing interest-free loans"
Business disruption (Optum Insight) $867 million "estimated business disruption impacts of $867 million"
Loans to care providers More than $9 billion Interest-free loans through 31 December 2024

Two cautions. First, the $9 billion is money lent to providers, not a loss, and the 10-K wording above refers to the "costs associated with" the loans, not their principal. Second, at the Senate hearing Witty said UHG had advanced "more than $6.5 billion in accelerated payments and no-interest, no-fee loans". That was an earlier snapshot, so the two figures don't conflict.

These are the company's disclosed costs only. They exclude what hospitals, pharmacies and practices lost while claims stalled, which no source we read quantifies.

What has HHS OCR done about the Change Healthcare breach?

We can confirm very little from the primary source. Our tools received HTTP 403 from the OCR frequently-asked-questions page and from OCR's March 2024 announcement, so we did not read them. We therefore make no claim about the investigation's scope, status or any outcome.

What we did read: UHG's own 10-K says the final count of individuals "will be confirmed and filed with the Office for Civil Rights". That tells you OCR is the destination for the breach report, nothing more.

To check OCR's position yourself, open the OCR Change Healthcare FAQ in a normal browser. Look for the filing date, the stated count and whether covered entities may delegate notification to Change Healthcare. Then confirm any penalty on OCR's enforcement pages. We did not find one in sources we could read.

If you want the comparison with a breach that ended in a published settlement, see our Equifax case file.

Going deeper: for security and IT teams

Threat model. A criminal group wants an extortion lever against an organisation that cannot afford downtime. Change Healthcare was that: UHG's own April 2024 release describes pharmacy claims and payment processing among the services affected. What the attacker needs is one remotely reachable system that accepts a login without a second factor. What it gets is both leverage (encrypted systems) and a second lever (stolen data).

What the primary sources establish about the attack path.

  1. Initial access through a portal without MFA (CEO testimony).
  2. A dwell period. The CEO's "probably 9 days" is an estimate given in answer to a senator, so we treat it as an approximation.
  3. Data exfiltration before encryption. UHG's April release says files containing PHI or PII were found, and screenshots were posted.
  4. Ransomware deployment on 21 February 2024 (10-K and testimony).

We have deliberately not assigned MITRE ATT&CK technique IDs. We did not open the technique pages in this research round, and the sources do not describe the intermediate steps (privilege escalation, lateral movement, staging). Mapping those would be guessing.

Controls that would have broken step 1 and shortened step 2.

  • MFA on every externally reachable portal and server, with an inventory that proves coverage. The failure in this case was a coverage gap: one portal outside the control. Test coverage rather than reading policy. Try to authenticate to each remote entry point with a password alone.
  • Attack-surface inventory after acquisitions. The sources we read do not say why this portal lacked MFA, so we draw no conclusion about the cause. The general lesson holds: put acquired and inherited systems under the same MFA and patching baseline from day one, and audit that baseline.
  • Segmentation between the remote-access tier and data stores, so a foothold on a portal does not mean reach to claims databases.
  • Egress monitoring. Bulk transfers to unfamiliar destinations should alert before encryption starts. A nine-day dwell leaves time for that alert to matter.
  • Recovery design. UHG reported about 80% of functionality restored on major platforms by 22 April, two months after discovery. Test restoration of the whole service, not individual servers, and measure the time.

Detection and evidence. Alert on successful remote logins to any account or system that does not show an MFA step in the identity provider logs. Alert on new administrative accounts, unusual volumes leaving the network, and security tools being disabled. After an incident, preserve identity-provider, VPN or portal, and firewall logs, because regulators and insurers will ask for the timeline.

Third-party concentration risk. If you are a provider or payer, ask what happens to your claims, eligibility checks and payments if a single clearinghouse is offline for weeks. UHG's interest-free loans to providers show the cash-flow impact was real. A business continuity plan that depends on one vendor's recovery time is a single point of failure.

What to verify or ask.

  • Which of our internet-facing systems can be reached with a password alone? Prove it by testing.
  • Do acquired or inherited systems meet our MFA standard today, and who signed that off?
  • If our critical vendor is down for four weeks, what is our manual process and our cash position?
  • Does our breach plan state who can authorise a ransom payment, what must be checked first, and how we notify regulators?

Which steps does the Change Healthcare attack call for now?

  1. List every externally reachable login (portals, VPN, remote desktop, vendor gateways) and confirm MFA on each.
  2. Include acquired companies and inherited systems in that list.
  3. Identify your single points of failure among vendors, and rehearse a four-week outage.
  4. Set an alert for large outbound transfers and for remote logins without MFA.
  5. Write down now who decides on a ransom payment and what legal and regulator contacts they need first.

Learn more

Key takeaways

  • UHG identified the Change Healthcare intrusion on 21 February 2024. Its 10-K estimates about 190 million people affected; a later 192.7 million figure was reported by Business Insurance.
  • UHG disclosed $2.2 billion in direct response costs and $867 million in business disruption impacts for 2024, plus more than $9 billion in interest-free provider loans.
  • The CEO told the Senate the attackers got in through a portal without MFA, and that UHG paid a $22 million ransom.
  • The 10-K says the final count goes to OCR. We could not open OCR's pages, so OCR's findings and any penalty are unverified here.
  • The practical lesson is coverage: MFA on every external entry point, including inherited systems, plus a plan for a critical vendor going offline.

Sources