Healthcare · USA · 4 min read
One password, no MFA: the Change Healthcare attack's billion-dollar bill
$2B+
in costs reported by UnitedHealth
In February 2024, criminals logged into Change Healthcare, a UnitedHealth unit that processes a huge share of US medical claims. Pharmacies and clinics could not get paid for weeks.
The bill
- UnitedHealth's CEO confirmed a $22 million ransom payment to Congress.
- Reported costs passed $2 billion within the year.
- Billions more advanced to struggling healthcare providers.
How it started
The CEO testified that attackers used compromised credentials on a remote-access portal that did not have multi-factor authentication.
What to do this week
- Turn on MFA for every remote login, no exceptions.
- Train staff to spot fake sign-in pages that harvest passwords.
- Audit old accounts nobody uses anymore.
Next breakdown
Supermarket freezers hacked: tens of millions of euros of food thrown away →