How the Change Healthcare breach happened: one password, no second factor

The biggest theft of American medical records started with one username and password typed into a remote-access portal that never asked for a second proof of identity.^[1][5] This case file covers how the Change Healthcare attack unfolded, what the $22 million ransom did and did not buy, and the one control that would have closed the door.

What happened

How they got in

No clever exploit was needed. The portal was built to let people work on the network from outside, and it trusted anyone who had the right username and password. UnitedHealth's chief executive, Andrew Witty, told Congress that the attackers used compromised credentials on a portal that lacked multi-factor authentication, the step that asks for a code or a phone prompt on top of a password.^[1] Later reporting described the account as belonging to a low-level support employee.^[5]

Once inside, the attackers had days to explore before anyone noticed. Witty said they moved sideways through systems and took data before launching the ransomware.^[2] Some of Change's technology was decades old, which made cleanup harder.^[9]

What it cost

Witty told lawmakers the decision to pay was his.^[1] The payment did not end the story. Days later, the ransomware group's leaders appear to have vanished with the money, and an affiliate who said they had done the actual break-in complained publicly that they had been cut out. In April that affiliate's new group demanded a second ransom and posted a portion of the stolen files as proof.^[5]

The data haul kept growing. In October 2024 UnitedHealth put the number of affected people above 100 million. In January 2025 it raised the figure to about 190 million, more than half the U.S. population, making it the largest known breach of American health data.^[5][7] The exposed information could include contact details, insurance information, health records and billing data.^[7]

To keep doctors' offices afloat while claims were frozen, UnitedHealth advanced more than $6.5 billion in accelerated payments and loans to providers.^[6] By the end of 2024 it said the attack had cost about $3.1 billion in response costs.^[7] No one had been charged over the attack in the sources reviewed.

The missing control

The missing control: multi-factor authentication on every remote-access portal, with no exceptions.

A stolen password is common and cheap. What turns it into a disaster is a door that accepts the password alone. With a second factor on that portal, the attackers would have held a password that did nothing without the employee's phone or security key. After the attack, Witty said every external-facing system across the company now has multi-factor authentication enabled.^[9] The lesson is that one overlooked gateway undoes the protection on all the others. Faster detection would also have helped: 9 days is a long time for intruders to wander unseen.

What to do in your business

• List every way in from outside. Write down every remote desktop, VPN, cloud admin page, email login and vendor portal. Old or test systems count too.
• Turn on multi-factor for all of them. Start with email, remote access and banking. Prefer an authenticator app or security key over text messages where you can.
• Close what you do not use. Shut down remote-access tools nobody needs, and remove accounts for people who have left.
• Watch for odd logins. Turn on alerts for sign-ins from new countries, new devices or odd hours, and have someone read them.
• Plan for the outage. Know how you would bill, pay staff and serve customers if a key vendor or system went dark for a month.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.