Change Healthcare’s Mega Attack: 1 Year Later

It’s been one year since Russian-speaking hackers unleashed ransomware on UnitedHealth Group’s Change Healthcare IT services unit. The attack shut down more than 100 critical software products and immediately disrupted critical patient care and business processes at thousands of U.S. hospitals and medical practices, with the recovery dragging on for months. After the dust finally settled, the attack resulted in a jaw-dropping health data breach that affected 190 million people, as of January.

See Also: Top 10 Technical Predictions for 2025

So, what did we learn from that massive disruption to the healthcare ecosystem and record-breaking protected health information compromise affecting nearly 60% of the U.S. population? What has changed – or what needs to change – in the aftermath of the Change Healthcare havoc?

According to the experts, the incident has undoubtedly shined a spotlight on many cybersecurity issues plaguing the healthcare sector including vendor and supply chain risk; incident prevention, detection, response and resiliency; and regulatory and legal concerns. And the big question: How prepared are we for the next catastrophic cybersecurity event?

“The CHC cyberattack demonstrated the extreme interconnectedness within our critical sector, a significant dependency on one vendor, and the fragility of the system when that vendor suffers an attack and is nonfunctional,” said Dr. Jesse Ehnrenfeld, immediate past president of the American Medical Association, a professional organization representing more than 250,000 physicians in the U.S.

“The Change Healthcare attack was a wake-up call about the risks of relying too heavily on a single vendor.”


– Dave Bailey, vice president, security services, Clearwater

Since the Change Healthcare breach, the AMA has advocated for stronger resiliency requirements for health plans, intermediaries and clearinghouses, Ehnrenfeld said.

“Increasing the cybersecurity requirements that clearinghouses must meet will help to prevent future harms to patients, physicians and the healthcare delivery system, and when a clearinghouse is unable to send and receive claims, streamlining provider enrollment in a new clearinghouse is imperative,” he told Information Security Media Group.

“The Change Healthcare attack was a wake-up call about the risks of relying too heavily on a single vendor. It showed just how much disruption can happen when a critical service goes down. Healthcare organizations need to take a look at their vendors, understand their dependencies, and have backup plans in place,” said Dave Bailey, vice president security services at consultancy Clearwater.

Indeed, the impact of the Change Healthcare outage on the business and delivery of healthcare was unprecedented.

Change Healthcare processes 15 billion transactions annually and touches one out of every three patient records, according to recent report by the American Hospital Association.

That includes software and services related to patient eligibility, billing, pharmacy, insurance claims, and a wide range of other processes.

An AHA survey in 2024 examining the effect of the Change Healthcare at nearly 1,000 hospitals found that 74% reported direct patient care impact, including delays in authorizations for medically necessary care. Also, 94% reported the attack affected them financially; 33% reported the attack disrupted more than half of their revenue; and 60% said they needed two weeks to three months to resume normal operations once Change Healthcare’s full functionality was re-established.

“The incident was an eye-opener because no one in the industry really realized how entrenched Change was in healthcare delivery,” said Denise Anderson, president of the Health Information Sharing and Analysis Center.

Unfortunately, concentration risk is a huge issue – and not just in healthcare – as illustrated by other incidents such as the July 2024 Crowdstrike outage – caused by a faulty software update, she said.

“A lot of healthcare organizations rely on the same vendor or set of vendors to deliver services – and if that vendor is impacted by an incident it can have cascading effects across the sector.”

In the aftermath of the attack on Change Healthcare, some organizations are reevaluating their reliance on having too few critical vendors. One of those providers is Florida-based Baptist Health, which operates six hospital and many other healthcare facilities.

Baptist is evaluating what other “Change Healthcare-type vendors” its health system rely that would have a major patient care or financial impact if they went offline, said James Case, CISO of Baptist Health. “We are identifying those, ranking them and identifying mitigation plans,” he told ISMG.

Apparently many other organizations are taking similar steps.

In October, Roger Connor, CEO of Optum Insight – the part of UHG that oversees the Change Healthcare unit – told financial analysts that while customers were still in the process of reconnecting, “what we’re seeing is the volume that’s coming back isn’t coming back to the pre-attack levels and customers are really looking for vendor redundancy.”

“What they’re looking for is another one or two sources of their software systems for example,” he said. “Now, we understand that. We think that’s a good thing for the health system that’s having an impact on us this year. But that also creates an opportunity for us,” he said.

“We’ve got an opportunity to go out and get new customers ourselves and become an additional supplier for them.”

“We did the right thing by shutting down the system to protect other systems from being impacted after the attack.”


– Company Spokesman, UnitedHealth Group

During the Change Healthcare IT disruption, services ranging from patient eligibility to claims processing going offline – mostly because Change Healthcare shut down its software products to isolate them from attack – resulting in financial havoc at many healthcare practices.

UHG provided $9 billion in interest-free loans to assist affected entities as they dealt with the disruption, a company spokesman said.

“We did the right thing by shutting down the system to protect other systems from being impacted after the attack,” he said. “The breach was contained to Change and did not affect any other legacy UnitedHealth Group systems. There was unprecedented speed at which we rebuilt the platform – shows how fast Optum Insight was able to rebuild under pressure,” he said.

Nonetheless, there is increased marketplace demand for “diversified vendor partnerships,” he said. “Threats and bad actors are out there and there is a need for backups.”

Falling Through the Cracks

UHG said it first detected the cyber incident on Feb. 21, 2024, which appears to have begun on Feb. 17 when attackers accessed a Citrix remote access service that the company failed to protect using multifactor authentication.

UHG admitted paying a $22 million ransom to the Russian-speaking ransomware group Alphv – aka BlackCat – after it claimed to have stolen 6 terabytes of the company’s data. BlackCat’s operators subsequently shut down their group and kept all of the money, rather than sharing the ransom with the affiliate who hacked Change Healthcare.

In response, that affiliate claimed to have taken the data to another ransomware-as-a-service group, RansomHub, and demanded a fresh ransom from Change. Whether UHG paid a second ransom demand isn’t clear.

Andrew Witty, UHG CEO, testified before two Congressional committees last spring saying that multifactor authentication on external-facing systems is in fact a cybersecurity standard at UHG, which acquired Change Healthcare in October 2022 (see: Multifactor Authentication Shouldn’t Be Optional).

The MFA lapse at Change Healthcare has prompted other healthcare security leaders to also double-check their organizations’ adherence to best practices.

“We know we have MFA required for all remote access, but Change Healthcare thought they did too,” said Baptist Health’s Case. “Therefore, we are now paying a third-party to do a complete MFA audit so we can prove it,” he said.

Multifactor authentication falling through the cracks at Change Healthcare after its purchase by UHG also brings highlights the many security risks related to mergers and acquisitions, experts said.

“Mergers and acquisitions are very complex. There are a lot of players at the table and there is a push to get a deal done,” Anderson said. “Often, security is the one of the last considerations. It is not easy to combine systems, operations and security procedures,” she said.

The Change Healthcare incident, which has already cost UHG north of $3 billion, “should be enough of an imperative for those who seek to push deals through to prioritize the security analysis and implementation,” she said (see: Change Healthcare Now Counts 190 Million Data Breach Victims).

Security needs to be part of the conversation from day one in any merger or acquisition, Bailey advises. “Organizations should assess cyber risks early, understand what they’re inheriting, and have a clear plan to close any gaps before integration.”

Rushing through the process without properly vetting security controls can leave both organizations exposed, he said. “Taking the time to conduct a thorough risk analysis, align security measures with the company’s risk tolerance, and put the right protections in place can help prevent major issues down the road.”

But the attack on Change Healthcare is also a stark reminder to organizations of any size – whether they’re part of a merger or acquisition or not – to ensure they carefully assess and mitigate enterprise security risks on an ongoing basis.

“Most ransomware attacks succeed due to basic security failures – such as weak passwords, unpatched systems, phishing,” Bailey said. Aligning security programs with frameworks like the National Institute of Standards and Technology and the 405(d) cybersecurity program – a collaborative effort between the Health Sector Coordinating Council and the federal government – is critical to helping mitigating these threats, he said.

Others offer a similar perspective. “Prevention strategies include MFA, endpoint protection, offline backups, regular patching, email security, and network segmentation,” are all critical, Anderson said.

“But C-suite buy-in is critical – investing in security upfront saves millions in recovery costs,” she added.

Data Retention Blunders

The enormity of the Change Healthcare breach affecting 190 million individuals is also stunning, and calls into question data retention and related practices in the healthcare sector, other experts said.

“Companies should be asking their vendors for the data retention policies and when they terminate their relationship, insist on having their data returned or having the vendor securely destroy it.”


– Sara Goldstein, regulatory attorney, BakerHostetler

“It has been reported that some of the data involved in the Change Healthcare incident is more than 25 years old,” said regulatory attorney Sara Goldstein of the law firm BakerHostetler.

“Although there are federal and state laws that require that certain documentation be retained for a set number of years, it appears as though Change Healthcare was maintaining information longer than they legally had to,” she said.

This should serve as a reminder to organizations that they should re-evaluate their data retention policies to see if they are actually followed and whether they need a refresh. “Companies should be asking their vendors for the data retention policies and when they terminate their relationship, insist on having their data returned or having the vendor securely destroy it and provide a certificate of destruction,” she said.

Additionally, “having a strong understanding of what data your organization maintains and where it is stored can help to quickly understand the scope of data involved in an incident and the approximate number of individuals the information pertains to,” she said.

Here Come the Feds

Lawmakers and regulators also must play an important part in trying to address and prevent the next Change Healthcare type of cyber crisis, experts said.

The U.S. Department of Health and Human Services’ Office for Civil Rights’ notice of proposed rulemaking issued in December to update the HIPAA security rule “was a step in the right direction in clarifying security and compliance expectations, but enforcement and resources remain a challenge,” Bailey said.

The proposed rule – which contains provisions that mandate certain security controls including MFA and encryption for HIPAA-covered entities and business associates – is open to public comment until March 7.

But some groups – especially smaller healthcare entities – are already opposing the potential new mandates, saying they would be too burdensome and expensive to implement (What’s in HHS’ Proposed HIPAA Security Rule Overhaul?).

“Many healthcare organizations struggle with the financial and staffing resources needed to implement strong cybersecurity programs,” Bailey said.

“Regulators and lawmakers should consider ways to incentivize investment in security – whether through funding, grants, or policy changes – so that providers, especially smaller organizations, have the tools and resources they need to protect patient data and respond effectively when an incident happens,” Bailey said.

That’s where Congress can potentially help, said other experts.

“Lawmakers can strengthen resilience to future cyberthreats by ensuring continued funding for cybersecurity resources at key agencies,” said Cassie Ballard, director of congressional affairs at the College of Healthcare Information Management Executives, a professional association of healthcare CIOs and CISOs.

Those critical agencies and programs include the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, NIST, and HHS’ Health Sector Cybersecurity Coordination Center and the 405(d) program, Ballard said.

“Tools such as threat briefs, cybersecurity advisories, and frameworks like 405(d) and the NIST CSF are invaluable to our members, particularly those with limited resources,” she said.

“In addition to funding, lawmakers should focus on policies that offer more carrots and less sticks in order to incentivize adoption of best practices. Our members have increased their spend on cybersecurity and are making meaningful improvements, and we need policymakers to work with us, not against us,” she said.

During the Biden administration, HHS was contemplating issuing new regulations that would mandate certain essential and enhanced cybersecurity performance goals for hospitals. But Biden’s term ended before such regs were released and whether the Trump administration would move forward with new mandates appear iffy (see: New Cyber Penalties May Strain Hospital Resources).

Nonetheless, it is just a matter of time before the healthcare sector confront the next massive cyberattack and enormous data breach, so preparation is critical, AMA’s Ehrenfeld said.

“Federal cybersecurity standards applicable to multibillion-dollar health plans and clearinghouses are the same as those that apply to rural medical providers,” he said.

“A data breach experienced by an individual provider poses minimal risk of industry disruption; however, the sheer size and volume of data loss by industry giants such as UnitedHealth Group and CHC, with $285 billion in annual revenues and stewardship of health data for millions of Americans, brought much of the health care sector to a standstill.”

HHS and other government agencies in the cybersecurity space should contemplate ways to make cybersecurity best practices affordable, attainable, and approachable for physicians without extensive health IT knowledge, experience or budgets, Ehrenfeld said.

“This is particularly critical for practices in which physicians have primary responsibility for the healthcare cybersecurity role at their respective organizations.”

Looking ahead, Change Healthcare and its parent UHG are slogging through a growing pile of proposed class action lawsuits and regulatory inquiries related to the attack and data breach that could drag out for years and cost millions of dollars in attorney fees, settlements and potential fines (see: Change Healthcare Attack: Recovery Woes, Lawsuits Pile Up).