Change Healthcare Breach Hits 100M Americans
Summary: Change Healthcare says it has notified approximately 100 million Americans that their personal, financial and healthcare records may have been stolen in a February 2024 ransomware attack, the largest known breach of protected health information. Intruders had stolen or purchased credentials for a Citrix portal used for remote access, and no multi-factor authentication was required for that account, per June 2024 Senate testimony.
Key Takeaway: UnitedHealth Group incurred $1.521 billion in direct breach response costs and $2.457 billion in total cyberattack impacts over the nine months ending September 30, 2024, including a $22 million ransom payment to BlackCat/ALPHV that did not stop the data from being offered for sale by RansomHub. A single remote-access account without MFA at a central payments and prescriptions processor reached 100 million people.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026