How the ransomware attack at Change Healthcare went down: A timeline

In February 2024 Change Healthcare—a major U.S. medical billing and claims processor owned by UnitedHealth—was hit by a ransomware attack attributed to ALPHV/BlackCat affiliates that disrupted healthcare billing systems nationwide, resulted in a reported $22M ransom payment, and led to the theft and subsequent extortion publication of highly sensitive medical and personal data affecting up to 190 million Americans; the attackers used compromised credentials lacking multi‑factor authentication and poor network segmentation to move within systems, and follow-on extortion by an affiliate (RansomHub) and legal and government responses followed.