Recommended Free Tools
UnitedHealth said attackers entered Change Healthcare on February 12, 2024, using compromised credentials to access a Citrix remote-access portal that did not have multifactor authentication enabled. The public account describes a credential and identity-control failure—not a confirmed exploit of a Citrix software vulnerability. Attackers moved laterally, removed data, and deployed ransomware nine days later, disrupting claims, payments, pharmacy transactions, eligibility checks, and other healthcare services.
What UnitedHealth told Congress
Andrew Witty, UnitedHealth Group’s chief executive, told the House Energy and Commerce Committee that criminals used compromised credentials to access a Change Healthcare Citrix portal remotely. The account was not protected by multifactor authentication, or MFA.
As an Amazon Associate I earn from qualifying purchases.
According to Witty’s prepared congressional testimony, the attackers gained access on February 12, 2024. They then moved through Change Healthcare’s environment, exfiltrated data, and deployed ransomware nine days later.
UnitedHealth confirmed that it paid a ransom and that Witty made the decision. However, the company did not confirm the widely reported $22 million figure. That amount should therefore be treated as a reported or estimated payment, not an established company disclosure.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Witty also said UnitedHealth’s initial targeted sampling found files containing protected health information (PHI) and personally identifiable information (PII). At that stage, the company said it had not seen evidence that doctors’ charts or full medical histories were included in the sampled data. That was a time-limited statement about initial sampling—not a guarantee that no medical records were exfiltrated.
Change Healthcare is a UnitedHealth Group subsidiary within Optum. Saying simply that “UnitedHealth was hacked” obscures which operating entity was compromised, although the consequences spread far beyond Change Healthcare itself.
Key source documents include UnitedHealth’s SEC filing, the House hearing record, and UnitedHealth’s April 22 incident update.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The timeline: access first, ransomware later
| Date | What happened |
|---|---|
| February 12, 2024 | Attackers used compromised credentials to access a Change Healthcare Citrix remote-access portal, according to Witty’s testimony. |
| February 12–21 | The attackers moved laterally through the environment and exfiltrated data. |
| February 21 | Ransomware was deployed nine days after the initial access. UnitedHealth identified the incident and began containment. |
| February 21–22 | UnitedHealth reported the cybersecurity incident and took systems offline or isolated them while investigating. |
| March 2024 onward | UnitedHealth and government agencies introduced restoration, financial-support, and continuity measures as providers dealt with claims and payment disruption. |
| May 1, 2024 | Witty testified before Congress. |
| July 19, 2024 | Change Healthcare filed a breach report with the HHS Office for Civil Rights concerning a ransomware attack involving PHI. |
The sequence matters. The ransomware deployment date was not necessarily the date of initial compromise. A valid account gave the attackers an entry point; the later movement, data theft, and encryption turned that entry into a major operational crisis.
Was this a Citrix vulnerability?
Not based on the evidence UnitedHealth publicly disclosed. The company described credential-based access to a Citrix remote-access portal without MFA. It did not establish that attackers exploited a defect in Citrix software.
Those are different events:
- Compromised credentials: An attacker possesses a legitimate username and password and uses them to authenticate.
- Missing MFA: The system does not require a second factor, such as a hardware security key or authenticator approval, that could stop a password-only login.
- Software vulnerability: An attacker exploits a flaw in the product itself to bypass authentication, execute code, or gain unauthorized access.
- Session or token theft: An attacker takes over an already authenticated session, potentially bypassing a new MFA challenge.
Calling the incident a “Citrix vulnerability” would imply a confirmed software exploit that the cited testimony does not establish. The more accurate description is that attackers used compromised credentials against a Citrix remote-access system whose access controls did not include MFA.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The distinction changes the remediation. Patching is central when a software flaw is exploited. A credential compromise requires investigation and revocation of passwords, sessions, tokens, certificates, and cached credentials; stronger MFA; account and privilege reviews; segmentation; and monitoring for further misuse.
How were the credentials obtained?
The public account used for this article does not establish how the credentials were originally compromised. UnitedHealth did not publicly say that they came from phishing, infostealer malware, password reuse, an insider, a third-party breach, a dark-web marketplace, or a particular Citrix exploit.
A later 2025 consolidated complaint alleged that a username and password for a low-level customer-support account appeared in a Telegram group advertising stolen credentials. That is a litigation allegation, not the same thing as a confirmed forensic finding, and it should be kept separate from UnitedHealth’s congressional testimony.
The unresolved theft mechanism is important. Security reporting should not fill an evidentiary gap with a plausible-sounding explanation.
Who carried out the attack?
ALPHV, also known as BlackCat, claimed responsibility and was widely associated with the Change Healthcare attack. The Congressional Research Service described that association in its analysis.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsA criminal group’s claim is not automatically a definitive government attribution. The careful formulation is that ALPHV/BlackCat claimed responsibility or was alleged to be responsible, rather than stating as an established fact that the group carried out every part of the intrusion.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why the outage spread through healthcare
Change Healthcare was a major intermediary in the U.S. healthcare system. Its services supported claims submission and adjudication, payment processing, pharmacy transactions, eligibility checks, prior authorizations, and related exchanges of healthcare data.
When Change Healthcare disconnected or isolated systems to contain the attack, organizations that were not themselves breached could still lose access to essential workflows. Providers could be unable to submit claims or receive payments. Pharmacies could encounter prescription-processing problems. Insurers, clearinghouses, and medical practices had to use manual processes or alternate routes where available.
The financial consequences were especially serious for smaller and rural practices with limited cash reserves. A provider could deliver care normally yet face delayed reimbursement because the transaction intermediary was unavailable. CMS issued a response memorandum describing measures intended to help affected providers and government-program participants manage the disruption.
This is also why operational reach and breach size should not be confused. The number of people whose care or payment workflow was affected is not the same as the number of people whose data was exfiltrated. Likewise, the number of individuals represented in potentially affected files is not proof that each person’s complete medical history was stolen.
A House committee chair said Change Healthcare processed approximately 15 billion medical claims annually and that more than roughly half of all claims passed through the company. Those figures are committee statements and should not be treated as independently audited measurements. UnitedHealth separately said affected files could represent a substantial proportion of people in the United States.
What remains uncertain
Several high-profile claims about the incident require qualifications:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- How the credentials were stolen: Not publicly established in the cited company testimony.
- Whether Citrix software was exploited: Not established; the disclosed mechanism was credential use against a Citrix portal.
- The ransom amount: UnitedHealth confirmed a payment but did not confirm the reported $22 million figure.
- The final number of affected people: Estimates and operational reach are not the same as a final confirmed victim count.
- The exact data taken: UnitedHealth confirmed PHI and PII in initial sampled files, while saying it had not seen evidence of doctors’ charts or full medical histories in that sampling.
- The precise account history: Public testimony does not fully describe the account’s privileges, lifecycle, monitoring, or how long it had been outside MFA coverage.
The HHS Office for Civil Rights confirmed that Change Healthcare filed a breach report on July 19, 2024, and that OCR opened investigations into Change Healthcare and UnitedHealth Group concerning potential HIPAA Privacy, Security, and Breach Notification Rule violations.
The acquisition and legacy-technology question
Congressional questioning also focused on UnitedHealth’s acquisition and integration of Change Healthcare. Witty described Change as an older company with older technology and said UnitedHealth had been working to upgrade it.
The evidence does not justify saying the acquisition directly caused the breach. It does support a broader risk-management concern: an acquired environment may not inherit the parent company’s identity policies, MFA enforcement, asset inventory, logging, segmentation, or incident-response procedures quickly enough.
A critical remote-access portal that remains outside centralized identity controls can become a security exception with disproportionate consequences. In a healthcare environment, that risk is amplified because one intermediary may connect thousands of providers, pharmacies, insurers, and public programs.
The M&A lesson is therefore not merely “buy better security software.” It is to make cybersecurity integration a condition of acquisition and post-close operations. Leaders need a verified inventory of remote-access systems, accounts, service identities, privileged paths, logging coverage, backup dependencies, and unresolved security exceptions.
What MFA would—and would not—have solved
MFA could have blocked or materially impeded the reported password-based entry. That makes the absence of MFA a serious control failure. It does not prove that MFA alone would have prevented the entire incident.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Attackers can sometimes steal authenticated sessions, abuse weak account-recovery procedures, compromise endpoints, exploit legacy MFA methods, or move laterally after gaining access. MFA also does not limit what an already authenticated account can reach.
A resilient program should combine MFA with:
- Phishing-resistant authentication: Prefer hardware security keys or passkey-based methods where practical, especially for administrators and remote access.
- Complete identity inventory: Find dormant, duplicate, contractor, service, emergency, and locally managed accounts.
- Least privilege: Ensure a low-privilege account cannot reach broad portions of a flat network.
- Segmentation: Separate remote-access infrastructure, administrative systems, clinical applications, backups, and sensitive data stores.
- Session and token control: After an incident, revoke active sessions and refresh tokens, not just passwords.
- Behavior monitoring: Investigate unusual locations, impossible travel, abnormal login times, unfamiliar devices, and access to atypical systems.
- Immutable and tested backups: Backups must be isolated from ordinary administrative credentials and regularly tested for restoration.
- Failover planning: Providers need rehearsed alternate clearinghouse, payment, claims, and pharmacy-processing routes.
A practical checklist for healthcare organizations
- Inventory every Citrix, VPN, virtual desktop, remote-support, and privileged-access portal.
- Require MFA everywhere, including acquired systems and legacy applications; document any exception and its compensating controls.
- Prioritize phishing-resistant MFA for administrators, help-desk staff, remote users, and accounts that can access sensitive systems.
- Remove dormant accounts and review contractor, vendor, service, and emergency credentials.
- Rotate passwords, API keys, certificates, active sessions, and refresh tokens when compromise is suspected.
- Restrict lateral movement with network segmentation and application-level access policies.
- Centralize authentication and logging where possible, while preserving visibility into systems that cannot be modernized immediately.
- Alert on anomalous remote logins and investigate activity after successful authentication—not only failed login attempts.
- Test isolated backups and restoration of claims, payment, eligibility, and clinical-support systems.
- Run a clearinghouse outage exercise with finance, revenue-cycle, pharmacy, compliance, clinical, and communications teams.
- Make cyber due diligence and security-control integration explicit milestones in every acquisition.
What the incident means for patients and providers
A patient may experience the incident operationally even when the patient’s own provider was not breached—for example, through delayed billing, prescription-processing problems, or authorization issues. Conversely, a breach notification does not necessarily mean that a person’s complete medical record was exposed. It means the organization identified potentially affected information under the applicable reporting process.
Providers should distinguish three separate questions: whether their own systems were compromised, whether their transactions depended on Change Healthcare, and whether their patient data appeared in files covered by the breach investigation. Those questions can have different answers.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOrganizations handling affected data should follow current notices from UnitedHealth, HHS, CMS, their insurers, and applicable state regulators rather than relying on broad headlines or unverified victim-count estimates.
The central lesson
The Change Healthcare attack began, according to UnitedHealth’s congressional account, with a valid credential, a high-impact remote-access pathway, and no MFA on the accessed portal. The broader failure was not just a missing security feature. It was the failure to ensure that identity controls, segmentation, monitoring, and resilience were consistently applied across an interconnected and partly legacy healthcare environment.
For healthcare executives, the most useful question is not whether a single product can prevent another Change Healthcare incident. It is whether every remote-access path is known, every identity is governed, every sensitive system is segmented, and every critical business process can continue when a central intermediary is unavailable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
