Change Healthcare hackers broke in using stolen credentials — and no MFA, says UHG CEO

UnitedHealth disclosed that the February ransomware attack on Change Healthcare involved attackers using compromised credentials to access an unprotected Citrix portal (no MFA), move laterally, exfiltrate terabytes of health data affecting a substantial portion of Americans, and deploy ransomware (claimed by RansomHub); UnitedHealth paid a ransom and reported over $870M in related costs.