The Change Healthcare ransomware attack began with intruders gaining access around 12 February 2024 and disrupted billing and claims across US healthcare from 21 February. Public testimony said attackers used a password on an account without multifactor authentication. The lessons for defenders are about identity, segmentation, recovery and dependence on one provider.
This timeline comes from one public reporting source, a TechCrunch chronology, and is not a forensic report. Sources we found disagree on some dates and numbers, so treat details as reported. Where another summary differed on when HHS first spoke publicly, we left that point out.
What happened, and when?
- About 12 February 2024. Hackers first broke into Change Healthcare's systems, roughly a week before the outage was noticed.
- 21 February. Billing and claims systems stopped across healthcare. Change shut down its network to isolate the intruders.
- 29 February. UnitedHealth said the attackers identified themselves as the ALPHV or BlackCat group.
- Early March. Reporting says UnitedHealth paid a ransom of 22 million dollars, after which ALPHV disappeared and an affiliate said it still held the stolen data.
- 15 April. A second extortion attempt appeared under a different group name, with some patient records published as proof.
- 22 April. UnitedHealth confirmed a data breach affecting a substantial proportion of people in America.
- 1 May. CEO Andrew Witty testified that attackers used a single password on a user account that lacked multifactor authentication.
- 20 June. Change posted a public HIPAA substitute notice.
- 29 July. Letters began going to known affected individuals.
- 16 December. The Nebraska attorney general alleged the entry came through a low-level customer support credential without multifactor authentication and that poor network segmentation let intruders move freely. That is an allegation in a lawsuit.
- 24 January 2025. UnitedHealth said about 190 million people had data stolen, nearly double the earlier estimate.
What should defenders learn?
Identity is the front door. If testimony is accurate, one password on one account without a second factor was enough. Audit which accounts, including old portals and vendor access, still lack multifactor authentication.
Segmentation limits the road. Allegations point to free movement inside the network. Test what a single compromised account can reach.
Dwell time is a metric. Roughly a week passed between access and the outage. Ask how quickly you would notice unusual activity in the first week.
Recovery has to be rehearsed. Systems were shut down to contain the intrusion. Practice running the business, or a clear manual fallback, while key systems are offline.
Concentration risk is real. A single clearinghouse stopping affected many providers. Map which of your vendors, if they stopped, would stop you, and what the manual workaround is.
Paying is not an exit. Reporting says the data was not reliably returned and a second extortion followed. Decide your position in advance with legal counsel.
Notification takes months. Counting and notifying affected people lasted well beyond the outage. Prepare the data mapping before you need it.
Where does supply chain tooling help?
Safeguard does not detect intrusions of this kind. What helps is knowing your own dependencies on third parties and software, and cutting the exposure of internet-facing systems. Dependency inventories and vulnerability findings address one part of that picture, and identity and recovery controls address the rest.
What to do
- List every account class that can reach sensitive systems and verify multifactor authentication on each.
- Test segmentation by listing what a typical help desk account can reach.
- Define how you would detect unusual access within days, not months.
- Run a recovery exercise with key systems offline.
- Rank vendors by how much of your business stops if they stop.
- Prepare a data map so notification work can start quickly.
Quick check
Was multifactor authentication the sole failure?
No. Public accounts also point to segmentation and recovery issues, though some are allegations and not findings.
How many people were affected?
UnitedHealth said about 190 million in January 2025. Earlier figures were lower, so check for updates.
Sources
Last reviewed: 18 October 2026.
