INCIDENT REPORT · CP-2024-003

Change Healthcare ransomware attack

L4 · CRITICALCONFIRMED

UnitedHealth Group disclosed that on 21 February 2024 it found a threat actor had accessed Change Healthcare IT systems, and ransomware was deployed. Change Healthcare processes a large share of US healthcare claims and payments.

Incident ID: CP-2024-003
Disclosure date: 21 FEB 2024
Detection date: 21 FEB 2024
Affected countries: United States
Plotted location: Nashville, United States (Affected organization headquarters (Change Healthcare))
Threat classification: Level 4 — CRITICAL
Classification rationale: Nationwide disruption of healthcare payments and pharmacy services; the largest US healthcare data breach by number of individuals.
Attack type: Ransomware
Nature: Malicious activity
Attack vector: Stolen credentials used on 12 February 2024 to access a Citrix remote access portal without multi-factor authentication (per CEO congressional testimony)
Sectors: Healthcare, Finance
Critical infrastructure: Yes
Organizations affected: Change Healthcare (UnitedHealth Group / Optum)
Operational consequences: More than 100 Change Healthcare applications across pharmacy, claims and payment services were disrupted nationwide. UnitedHealth estimates about 190 million individuals were affected and says it paid a $22m ransom.
Estimated financial impact: $3.1B — UnitedHealth Group's FY2024 year-end earnings, as reported by Becker's: about $3.09bn total cyberattack impact, including $2.2bn in direct response costs (the $2.2bn figure also appears in the FY2024 10-K).
Attribution (as stated): Attributed by UnitedHealth Group (CEO Andrew Witty's congressional testimony) to the ALPHV/BlackCat ransomware group

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Change Healthcare ransomware attack

L4 · CRITICALCONFIRMED

Incident ID

CP-2024-003

Disclosure date

21 FEB 2024

Detection date

21 FEB 2024

Affected countries

United States

Plotted location

Nashville, United States (Affected organization headquarters (Change Healthcare))

Threat classification

Level 4 — CRITICAL

Classification rationale

Nationwide disruption of healthcare payments and pharmacy services; the largest US healthcare data breach by number of individuals.

Attack type

Ransomware

Nature

Malicious activity

Attack vector

Stolen credentials used on 12 February 2024 to access a Citrix remote access portal without multi-factor authentication (per CEO congressional testimony)

Sectors

Healthcare, Finance

Critical infrastructure

Yes

Organizations affected

Change Healthcare (UnitedHealth Group / Optum)

Operational consequences

More than 100 Change Healthcare applications across pharmacy, claims and payment services were disrupted nationwide. UnitedHealth estimates about 190 million individuals were affected and says it paid a $22m ransom.

Estimated financial impact

$3.1B — UnitedHealth Group's FY2024 year-end earnings, as reported by Becker's: about $3.09bn total cyberattack impact, including $2.2bn in direct response costs (the $2.2bn figure also appears in the FY2024 10-K).

Attribution (as stated)

Attributed by UnitedHealth Group (CEO Andrew Witty's congressional testimony) to the ALPHV/BlackCat ransomware group