UnitedHealth Congressional Testimony Reveals Rampant Security Fails

UnitedHealth's Change Healthcare subsidiary was breached in February when BlackCat/ALPHV affiliates used previously compromised Citrix credentials (without MFA) to move laterally, exfiltrate large amounts of PII/PHI, and deploy ransomware; the company paid a $22 million ransom, discovered the attack after more than a week of attacker access, and faced widespread operational impact, inadequate backup segmentation, and potential exposure of data for a substantial proportion of Americans.