What the Change Healthcare Breach Should Have Taught Every Health Tech Company

In February 2024, Change Healthcare — one of the largest healthcare technology companies in the United States — was hit by a ransomware attack that compromised 190 million patient records. It disrupted claims processing for months, cost UnitedHealth Group over $3 billion, and became the largest healthcare data breach in U.S. history.

The root cause was almost embarrassingly simple: a Citrix remote access portal without multi-factor authentication.

If you're building or running a health tech company, this breach isn't just a news story. It's a case study in what happens when basic security controls are missing at scale.

The attackers, a ransomware group called ALPHV (also known as BlackCat), gained access to Change Healthcare's environment through a Citrix remote access account that wasn't protected by MFA. Once inside, they moved laterally through the network for nine days before deploying ransomware.

Nine days. Inside one of the most critical pieces of healthcare infrastructure in the country. Undetected.

During those nine days, the attackers exfiltrated data on approximately 190 million individuals, including names, addresses, Social Security numbers, medical records, insurance information, and billing data. Then they encrypted systems and demanded a ransom.

UnitedHealth Group, Change Healthcare's parent company, paid $22 million to the attackers. The disruption to healthcare claims processing affected providers, pharmacies, and patients across the country for months.

1. MFA is not optional. Anywhere.

The single control that would have prevented this breach is one that every security framework requires and every security professional recommends: multi-factor authentication.

Change Healthcare had MFA on some systems but not all of them. The Citrix portal that was compromised was an exception. In security, exceptions are where breaches happen.

If you have any system, anywhere in your environment, that can be accessed remotely without MFA, fix it today. Not next sprint. Today. This includes VPNs, cloud consoles, admin panels, CI/CD pipelines, and any service that has a login page.

2. Network segmentation limits blast radius.

Once the attackers got through the Citrix portal, they were able to move laterally across Change Healthcare's network for over a week. That's a segmentation failure.

In a properly segmented environment, compromising one system doesn't give you access to everything. Critical systems — especially those containing patient data — should be isolated from general corporate infrastructure. Lateral movement should be difficult, detectable, and contained.

For startups, this often means rethinking your cloud architecture. Are your production databases accessible from your corporate network? Can someone with access to your internal tools reach your customer data stores? If the answer is yes, you have a segmentation problem.

3. Detection speed matters more than prevention perfection.

Nine days of undetected lateral movement. That's the number that should keep health tech CISOs up at night.

You will never prevent every intrusion. But you should be able to detect an attacker moving through your network within hours, not days. That requires centralized logging, monitoring, and alerting on suspicious activity.

At minimum, you should have alerts on: unusual login patterns, privilege escalation, large data transfers, new service accounts being created, and access to sensitive data stores from unexpected sources.

4. Third-party risk is your risk.

Thousands of healthcare providers relied on Change Healthcare for claims processing. When Change went down, they went down too. Many couldn't process claims for weeks. Some couldn't verify insurance coverage. The downstream impact was massive.

If your company depends on third-party services, their security posture is part of your risk profile. Ask your critical vendors about their security controls. Review their SOC 2 reports. Understand their incident response capabilities. And have a contingency plan for when a critical vendor goes offline.

5. Incident response plans need to be tested, not just written.

Having an incident response plan is a compliance requirement for HIPAA-covered entities. Change Healthcare had one. The question is whether it was tested and exercised regularly, because the response to this breach was messy, slow, and poorly communicated.

Run tabletop exercises at least annually. Simulate scenarios that involve your most critical systems going offline. Test your communication plan. Make sure your team knows who to call, what to do, and how to make decisions under pressure.

The Change Healthcare breach wasn't caused by a sophisticated zero-day exploit or a nation-state attacker using novel techniques. It was caused by a missing MFA control on a remote access portal.

That's the uncomfortable reality of most breaches. They don't happen because attackers are brilliant. They happen because defenders left a door open.

For health tech companies, the lesson is clear: get the basics right. MFA everywhere. Network segmentation. Monitoring and detection. Vendor risk management. Tested incident response. These aren't innovative security strategies. They're table stakes.