Change Healthcare ransomware attack exposed massive patient data and disrupted U.S. care

A ransomware attack on UnitedHealth subsidiary Change Healthcare crippled prescription processing, billing, and claims services across the U.S., leaving pharmacies, hospitals, doctors, and therapists unable to process insurance transactions and creating severe cash-flow problems for providers. UnitedHealth disclosed the intrusion after isolating affected systems, and the ALPHV/BlackCat gang later claimed responsibility, saying it stole terabytes of data from the company’s environment. The outage highlighted Change Healthcare’s central role in the health sector, where it processes a huge share of medical and pharmacy transactions.

UnitedHealth later acknowledged paying a ransom reportedly worth about $22 million in bitcoin, but the extortion did not end there: a second group, RansomHub, claimed it had obtained the stolen files and began leaking patient data online. Subsequent reporting said the breach likely included highly sensitive personal and health information, potentially affecting U.S. service members and eventually tens of millions of Americans, with later estimates rising to 100 million and then 193 million victims. Investigators and executives also said the attackers entered through a Citrix portal without MFA, turning the incident into one of the largest and most consequential healthcare data breaches on record.