The Change Healthcare outage: what one missing login step cost

About this series

February 2024: A system-wide freeze

On February 21, 2024, the U.S. healthcare system hit a wall. Change Healthcare, a unit of UnitedHealth Group, was hit by a massive Ransomware (show definition) attack. The company processes nearly 15 billion medical claims a year and handles about 40 percent of all U.S. healthcare transactions. When they went offline to stop the attack, the ripple effect was immediate.

Pharmacies could not check insurance coverage for prescriptions. Doctors could not submit claims for payment. Small medical practices, which often operate on thin margins, suddenly found themselves with no incoming cash. The outage lasted for weeks, forcing some providers to take out emergency loans just to keep their doors open.

The entry point: A portal without MFA

The attackers, a group known as ALPHV or BlackCat, reportedly entered the network through a Citrix remote-access portal. According to later testimony by company executives, that specific portal did not have multi-factor authentication (Multi-factor authentication (MFA) (show definition)) enabled. The attackers only needed a stolen username and password to get inside.

This is a classic example of a 'legacy' system problem. Large companies often have thousands of systems. While their main tools might be well-protected, older portals or secondary access points are sometimes overlooked. For an attacker, these weak spots are the preferred target because they offer the easiest path to the heart of the network.

The ripple effect and the cost of trust

Once inside, the attackers stole terabytes of data. This included names, addresses, and sensitive health information for a massive fraction of the American population. The company reportedly paid a ransom of approximately 2 million to try and protect that data, though the effectiveness of such payments is often debated by security experts.

For the healthcare industry, the attack was a wake-up call about single points of failure. Change Healthcare had become so dominant in the market that its failure became everyone's failure. Small clinics realized they had no contingency plan for a world where their primary payment processor simply stopped working.

Lessons for the healthcare front line

If you run a medical practice, a behavioral health clinic, or a senior living facility, the Change Healthcare incident carries direct lessons for your own security posture. You may not be as large as UnitedHealth, but you are part of the same connected ecosystem.

• Enforce Multi-factor authentication (MFA) (show definition) on every single entry point, including old portals and VPNs.
• Identify your 'critical' vendors—the ones you cannot operate without for more than 24 hours.
• Have a backup plan for billing and claims if your primary Practice management or job management system (show definition) system or clearinghouse goes down.
• Regularly review who has Administrator access (show definition) to your systems and remove access for anyone who doesn't need it.

Strengthening your clinic's defenses

• Confirm Multi-factor authentication (MFA) (show definition) is active for every user on your EHR and email
• Identify an alternative way to process payments if your main portal fails
• Review your HIPAA (show definition) compliance plan to ensure it covers third-party outages
• Test your offline backups of patient records and aging reports (show definition)
• Train staff to recognize the Phishing (show definition) attempts that often follow a major breach