Case study · Healthcare

Change Healthcare: one portal without MFA stalls US medical billing

United States, 2024. Ransomware hits a central intermediary of the healthcare system and disrupts pharmacies and providers for months.

In one sentencePolicy required multi-factor authentication; one portal was the exception. Verify, don't assume.

Analysis based solely on public information. FZ Consultation was not involved in this incident and has no affiliation with the organizations named.

What happened

12 February 2024
Attackers log in to a Citrix remote access portal with compromised credentials. The portal did not require multi-factor authentication.
12–21 February 2024
They move through the network and exfiltrate data for about nine days.
21 February 2024
Ransomware is deployed. The company shuts down its data centres, halting electronic exchanges between providers, payers and pharmacies.
March–April 2024
A $22m ransom is paid. An affiliate nevertheless keeps the data, and a second extortion is launched by another group.
May 2024
The parent company's CEO testifies before Congress and confirms MFA was missing on the portal.

According to the public sources listed below.

According to the CEO's testimony, MFA was company policy for external systems, but this portal was an exception.

The company processes a major share of US healthcare transactions: its outage became an outage for a whole sector.

The ransom did not stop the data from being kept, nor a new extortion attempt.

1
Verify, don't assume
Regularly check that every exposed access point really enforces MFA, including after an acquisition.
Prepare: recovery that holds
2
Plan for losing an intermediary
Identify suppliers whose outage would stop your business and prepare fallbacks.
Know: measure what stopping would cost
3
Plan recovery without a ransom
Isolated, tested backups are the only guarantee of recovery.
Prepare: recovery that holds

Three questions to put to your own organization this week. If you cannot answer one of them in five minutes, that is your first task.

Test every exposed access point: does it really enforce a second factor, including systems inherited through an acquisition?
Which intermediary, if it went down, would stop your business, and what is your fallback?
Could you restore without paying? When did you last restore for real?