Storm⚡️Watch | Cyber Insights | Change Healthcare Fallout Continues: Massive Healthcare Data Breach Impacts Millions
Summary: The Change Healthcare cyberattack, discovered February 21, 2024 and attributed to the ALPHV/BlackCat ransomware group, began when attackers used stolen credentials on a Citrix remote access portal without multi-factor authentication on February 12 and went undetected for nine days before deploying ransomware. The breach potentially exposed personal details, health records, billing and claims data, and Social Security numbers for up to one-third of the U.S. population, and UnitedHealth Group advanced over $2 billion to providers to offset the disruption.
Why it matters: A single Citrix portal without MFA gave attackers nine undetected days to move laterally and exfiltrate data affecting up to one-third of Americans, and the parent company had to advance more than $2 billion to keep providers afloat while 99% of pharmacy network services took until March 18 to restore.
Read the original at GreyNoise Blog ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026