How the ransomware attack at Change Healthcare went down: A timeline

A February 2024 ransomware attack against Change Healthcare (owned by UnitedHealth) by an ALPHV/BlackCat affiliate — later tied to a new extortion group called RansomHub — caused nationwide healthcare outages, double-extortion data theft, and extensive disruption. UnitedHealth paid a reported $22 million ransom; the stolen dataset was leveraged for further extortion and partial publication, and the breach ultimately expanded to affect an estimated 190 million Americans, making it one of the largest medical data breaches in U.S. history.