Change Healthcare hacked using stolen Citrix account with no MFA

UnitedHealth confirmed that Change Healthcare was breached by the ALPHV/BlackCat ransomware operation in mid-February 2024 after attackers used stolen Citrix credentials (on a portal without MFA) to access and move laterally within systems; ransomware was deployed on February 21, causing widespread disruptions to billing, prescriptions, and payment processing, exposure of PHI/PII, an estimated $872M loss, and subsequent ransom/extortion activity, with post-incident remediation including credential rotations and complete rebuilds of core services.