UnitedHealth CEO tells Senate all systems now have multi-factor authentication after hack

UnitedHealth Group testified to senators that a ransomware attack on its subsidiary Change Healthcare occurred after attackers used stolen credentials to access a server not protected by multi-factor authentication; the attackers exfiltrated personal and health data affecting a substantial proportion of Americans, encrypted systems, and received a $22 million payment. UnitedHealth says it is enabling MFA across external-facing systems and is still determining the full extent of the breach.