Change Healthcare Breach Timeline: Attack to National Healthcare Disruption

The attackers gained initial access through a Citrix portal lacking multi-factor authentication — a basic security control. Despite paying a $22 million ransom UnitedHealth faced a second extortion attempt from a different group who claimed to still have the data.

The breach at UnitedHealth/Change Healthcare exposed 100 million+ records through blackcat/alphv ransomware via citrix portal without mfa. 100 million+ individuals across the US healthcare system The incident highlights the ongoing challenges organizations face in protecting sensitive user data against increasingly sophisticated attack vectors. Security researchers have noted that breaches of this magnitude often result from a combination of technical vulnerabilities and organizational failures in security practices.

Current status: Systems largely restored; notification ongoing; congressional investigation. Affected users should take immediate steps to protect their accounts, including changing passwords, enabling multi-factor authentication, and monitoring financial accounts for unauthorized activity. Filing a DSAR with UnitedHealth/Change Healthcare can help you understand what data was exposed and request its deletion.