Change Healthcare's CEO told the US Senate in May 2024 that attackers entered a portal that was not protected by multifactor authentication, deployed ransomware on 21 February 2024, and had probably been inside about nine days earlier. The useful question is not who failed. It is whether your own remote access, detection and recovery would hold.
What did the company say happened?
This post uses one source: the transcript of the Senate Finance Committee hearing on 1 May 2024. Everything below is the CEO's own testimony or his answers to senators.
- Cybercriminals entered a Change Healthcare portal, took data, and on 21 February deployed ransomware.
- The portal "was not protected by multifactor authentication."
- Based on later forensics, he believed they entered "probably 9 days before."
- The company contacted the FBI within hours and "severed connectivity" to contain the attack.
- He said the decision to pay a ransom of 22 million dollars was his.
- The platform was rebuilt "from scratch," and he reported more than 6.5 billion dollars in accelerated payments and no-interest loans to providers.
- He gave no firm count of affected people at the hearing and said there was no evidence at that point that full medical histories were taken.
The testimony did not explain how the attackers obtained access, and this post does not guess.
Attackers choose targets with weak points. Any large organisation that has acquired companies over the years carries some old systems. The checklist below is meant to find yours.
The checklist
- Can you list every remote access path? Portals, VPNs, remote desktop, vendor accounts. Include the ones inherited through acquisitions.
- Does every one require MFA, with no exceptions? Test it by trying to sign in with only a password.
- Is MFA phishing resistant for admins? Prefer hardware keys or passkeys over codes sent by text.
- Do you have a single place that shows a new login from a new location? Nine days of quiet access is the window your detection would have to close.
- Could you notice large data leaving? Set alerts on unusual outbound volume from systems that hold sensitive records.
- Do you know your most connected system? If it fails, which hospitals, pharmacies or customers stop? Write down the dependency chain.
- Is there a manual fallback for your critical function? Claims, payments and orders need a degraded mode with an owner.
- Can you rebuild from clean media and in what time? The platform here was rebuilt "from scratch." Measure your own time.
- Is there a decision process for ransom demands before the day? Who decides, who advises, what law applies.
- Do customers and partners know how to reach you in an incident? Communication was part of the story here.
How should a team use it?
Score each item red, amber or green, and attach an owner and date to every red. Repeat quarterly. Items 1 and 2 are cheap, and they are the ones this testimony points at most directly.
For the software side, the inventory behind item 1 is easier when your repositories, services and dependencies sit in one register. Safeguard's compliance automation can hold the evidence for controls like MFA enforcement next to your other framework requirements.
What to do
- Run the checklist with security, infrastructure and operations in one room.
- Fix any remote access path without MFA before anything else.
- Add an alert for first-time sign-in locations on privileged accounts.
- Time one rebuild exercise and record the result.
- Document who decides on a ransom demand and who they consult.
Quick check
What did Change Healthcare say about MFA?
At the 1 May 2024 Senate hearing its CEO said the portal the attackers accessed was not protected by multifactor authentication.
Did he explain how the attackers got in?
No. The testimony did not describe how access was obtained, so avoid repeating guesses as fact.
Sources
Last reviewed: 18 October 2026.
