Change Healthcare Hack: 6 Failures Behind the 192.7 Million Record Breach

The Change Healthcare hack became public on February 21, 2024, when ransomware locked the systems of a US company that passes insurance claims and payments between doctors, pharmacies and insurers. The break-in itself started nine days earlier, with one stolen login on a remote-access portal that had no second factor. That single gap, confirmed by the parent company's own chief executive, led to a breach that US health regulators now put at about 192.7 million people.

This case study looks at the mistakes in order, so you can see where the chain could have been broken. Here is what you will get:

• A dated timeline, from the first login to the final count of 192.7 million people
• A plain-language picture of how the attack moved from one portal to a national outage
• Six specific failures, each paired with the control that would have helped
• The money: a $22 million ransom and about $3.1 billion in 2024 costs
• Seven defensive lessons you can apply in a Pakistani clinic, lab or billing office

What Was the Change Healthcare Hack?

Change Healthcare is part of UnitedHealth Group, one of the biggest names in US health insurance. It runs a clearinghouse, which is a middleman that checks and forwards medical claims, prescriptions and payments. According to Healthcare IT News, the company processes about 15 billion healthcare transactions a year.

When that middleman went dark, the effect spread far beyond one company. Pharmacies struggled to bill insurance for prescriptions. Hospitals and small practices waited for payments that normally arrived within days. In his written testimony to the US Senate Finance Committee, UnitedHealth Group CEO Andrew Witty said Change handles about 6% of all payments in the US health system.

The Change Healthcare cyberattack had two parts. First, criminals copied a huge amount of personal and medical data. Then they encrypted the systems and demanded money. Ransomware groups call this double extortion: pay to get your systems back, and pay again to keep the stolen files off the internet.

Change Healthcare Hack Timeline: From One Login to 192.7 Million People

The dates below come from the CEO's testimony, US government pages and reporting from the time. US Eastern time in February runs 10 hours behind Pakistan, so a US morning lands in the Pakistani evening.

How Did One Login Open the Door?

Witty's testimony gives the starting point in plain terms. On February 12, criminals used compromised credentials to reach a Citrix portal, a tool staff use to open a remote desktop from outside the office. That portal, he said, did not have multi-factor authentication. A username and password were enough.

The testimony does not say how the password was stolen. Common routes in other cases include phishing pages, malware that harvests saved browser passwords, and passwords reused from older leaks. Treat any specific claim about this case as unconfirmed unless the company or investigators publish it.

Once inside, the intruders had time. The Register's account of the hearing reports that they moved laterally and took data for about nine days before launching the ransomware on February 21. Lateral movement simply means hopping from the first machine to other servers and accounts, collecting more access along the way.

Encryption was the noisy final step of the Change Healthcare hack, not the start. By the time screens locked, the data was already gone. That is why restoring from backups could bring systems back but could not undo the theft.

What Went Wrong: Six Failures Behind the Breach

None of the failures behind the Change Healthcare hack is exotic. Most of them appear on any basic security audit checklist, which is exactly what makes this case useful for students.

1. A Remote Door With Only One Lock

The portal accepted a password alone. Multi-factor authentication adds a second proof, such as a code from an app or a hardware key, so a stolen password stops being enough. Witty told lawmakers UnitedHealth has since turned it on. The control cost little compared with what followed.

2. A Stolen Credential That Still Worked

Someone's valid login was in criminal hands and nothing blocked it. Systems that flag sign-ins from new devices, unusual countries or odd hours can catch this early. So can regular reviews that remove remote access people no longer need.

3. Nine Quiet Days Inside the Network

Copying large volumes of data usually leaves traces: unusual traffic, new admin sessions, tools that do not belong on a server. Nine days passed between entry and encryption. Good monitoring shortens that window, and every hour matters during a ransomware attack.

4. One Company Holding Up a Whole Sector

When one clearinghouse touches 15 billion transactions a year, its outage becomes everyone's outage. Any provider without a backup route for claims felt it at once. That concentration risk was a business decision as much as a technical one.

5. A Ransom That Bought No Guarantee

UnitedHealth paid $22 million, Witty confirmed. Healthcare IT News reported that the affiliate then claimed ALPHV's leaders kept the money and vanished. Weeks later a second group, RansomHub, claimed to hold 4 terabytes of the same data, according to SentinelOne's analysis. The 4 TB figure is the criminals' claim, not a verified measurement.

6. A Count That Took 17 Months

The first breach report used a placeholder of 500 people. The final figure of about 192.7 million arrived on July 31, 2025. Some of the delay came from the sheer size of the data, but it left patients and providers guessing. Nebraska's lawsuit alleges the company was slow to notify residents; that is an allegation the court has not yet decided.

How Much Did the Healthcare Data Breach Cost, and Why Do the Numbers Keep Changing?

Two sets of numbers moved during the year after the Change Healthcare hack: the money and the people. Both grew as investigators learned more, so older articles often quote figures that are now out of date.

On cost, The Register reported in April 2024 that UnitedHealth had spent $870 million so far and expected the total for the year to reach up to $1.6 billion. By October, the company raised its estimate to about $2.87 billion. In January 2025, Healthcare Dive reported the final 2024 figure as $3.1 billion. Those totals include response work, lost business and support payments to providers.

Providers needed cash while claims were stuck. Witty's testimony says UnitedHealth Group had advanced more than $6.5 billion in accelerated payments and interest-free loans by April 26, 2024.

On people, the HHS Office for Civil Rights FAQ tracks how the count changed:

Notice the change in what is measured. The October figure counted letters sent, while the later figures counted people affected. Mixing the two is a common reporting mistake.

Who Was Blamed, and How Sure Is Anyone?

Confirmed: in his testimony on the Change Healthcare hack, UnitedHealth's CEO named ALPHV/BlackCat as the ransomware, and the company confirmed paying the ransom. ALPHV BlackCat ransomware works as a service. A core group writes the malware and runs the payment sites, while affiliates break into victims and share the profits.

The group was not new to investigators. The US Justice Department said in December 2023 that ALPHV had targeted more than 1,000 victims and ranked as the second most prolific ransomware service. That disruption clearly did not end its operations.

Less certain: the identity of the individual affiliate. Public reporting relies on forum posts by criminals, and SentinelOne describes the link between the affiliate and the later RansomHub extortion as a belief rather than a confirmed fact. Healthcare IT News reported a US State Department bounty of as much as $10 million for tips that identify or locate ALPHV members. I found no arrest tied to this attack in any source used here.

What Happened Afterwards?

Recovery from the Change Healthcare hack came in stages. Pharmacy claims recovered first, with 99% of pharmacies back online by March 7, 2024, per the testimony. Medical claims were flowing at near-normal levels by the hearing, while payment processing stood at about 86% of earlier levels. The response team replaced thousands of laptops, rotated credentials and rebuilt the data center network, with help from firms including Mandiant and Palo Alto Networks.

Regulators and courts followed. HHS's Office for Civil Rights opened investigations in March 2024 and told hospitals and clinics they could let Change send the required notices on their behalf. Nebraska's attorney general filed suit in December 2024, and Becker's reported in November 2025 that a judge allowed the case to continue. Nebraska says nearly half the state's residents were affected.

The case also shaped policy debate. Witty told Congress he supports mandatory minimum cybersecurity standards for healthcare, developed by government and industry together.

Why Should a Clinic or Billing Firm in Pakistan Care?

You might think the Change Healthcare hack has little to do with a hospital in Peshawar or a lab in Multan. The pattern says otherwise. Pakistani organizations already face the same criminal business model, as the K-Electric ransomware attack and the FBR cyber attack showed.

Three points carry over directly. First, remote access is everywhere now: doctors check reports from home, vendors support hospital software over the internet, and billing staff work remotely. Second, if your firm handles US patient records for medical billing or coding clients, a US healthcare data breach could start on a laptop in your office. Third, patient records are permanent. You can change a card number, but you cannot change a diagnosis.

If you only manage your own accounts, the takeaway is smaller but real. Turn on two-step verification for email and WhatsApp, and read our WhatsApp account recovery checklist before you ever need it.

Seven Defensive Lessons for Your Organization

These lessons follow the failures behind the Change Healthcare hack. They suit a 20-bed hospital as well as a large billing company.

1. Require multi-factor authentication on every remote login. That includes VPNs, remote desktop portals, email and vendor accounts. App-based codes or hardware keys are stronger than SMS.
2. Keep a list of who has remote access. Review it every month and remove ex-staff, old vendors and unused accounts.
3. Alert on unusual sign-ins. New country, new device or 3 AM access to an admin account should reach a person quickly.
4. Separate critical systems. A single remote desktop should not lead straight to billing databases and backups.
5. Watch for large outbound transfers. Data theft usually happens before encryption, so catching it early limits the damage.
6. Keep offline, tested backups. Restore a sample regularly, and keep at least one copy that ransomware cannot reach.
7. Plan for a vendor outage. Write down how you would bill, dispense or report if your main software provider went offline for a month.

The same habits appear in our earlier case studies. The Colonial Pipeline hack also traced back to one old VPN login, and the Binance hack showed how quickly stolen access turns into stolen value.

Taking Apart a Health Sector Breach in PSTA's Course

A news story tells you what broke. Piecing the timeline together from logs and notes teaches you how to spot it next time. PSTA runs its Cyber Security & Ethical Hacking course over 12 weeks at beginner level, live online across Pakistan or on campus in Abbottabad.

The course page lists modules on core principles such as the CIA triad and risk, common attacks including phishing and social engineering, network defenses like firewalls, VPNs and intrusion detection, malware and threat detection, and digital forensics with Pakistan's cyber laws. One lab asks you to investigate an incident, preserve evidence and write a timeline, which is the same skill the Change Healthcare hack calls for. The course ends with a case-study project.

Students who finish the foundations can move on to Advanced Ethical Hacking and Penetration Testing, a course on authorized testing that teaches you to find weak remote access before criminals do. Planning an exam? Our beginner certification guide lists the usual first steps. To ask about the next batch, message PSTA on WhatsApp at +92 314 5424399.

Audit One Remote Login Before Monday

Pick one system your office reaches from outside: email, a VPN, a hospital information system or a vendor portal. Sign in as a normal user and check whether it asks for a second factor. If it does not, ask your IT lead what it would take to switch it on this month. That one check is the lesson of the Change Healthcare hack in practical form.