CASE-15 · Case Study — Change Healthcare: No MFA on the Door

What happened

In February 2024, the BlackCat ransomware group — also tracked as ALPHV — broke into Change Healthcare, one of the largest healthcare payment and claims-processing networks in the United States, part of UnitedHealth Group's Optum unit. The entry point was mundane: a Citrix remote-access portal, reachable from the public internet, that accepted a plain username and password. That portal did not have multi-factor authentication (MFA) enabled. With valid credentials and nothing else standing in the way, the attackers logged in as if they belonged there.

Once inside, they moved laterally through the network over a period of days, and then deployed ransomware across it. The result was one of the most disruptive healthcare-sector cyberattacks on record: claims processing and pharmacy systems went dark nationwide, and the outage stretched on for weeks. Because so much of American healthcare billing flows through Change Healthcare, the failure of one company's internal network rippled out to pharmacies, hospitals, and clinics across the country.

See it — root cause to control

flowchart TD
    A["Citrix remote portal<br/>on the public internet"] --> B["No M.F.A. —<br/>password is the only lock"]
    B --> C["Attacker logs in with<br/>stolen credentials"]
    C --> D["Lateral movement,<br/>then ransomware"]
    A -.-> E["Control: M.F.A. on<br/>every remote entry point"]
    D -.-> F["Control: segmentation +<br/>tested recovery"]

The root cause

The root cause fits in a single sentence: a critical remote-access entry point had no second factor. A password, by itself, is a single lock — and passwords leak, get phished, get reused, and get bought. When the only thing between the internet and your internal network is one shared secret, an attacker who obtains that secret is simply authenticated. There is no anomaly to trip, no second challenge to fail. MFA exists precisely to break that single-point-of-failure: it adds a second, independent factor — something you have or something you are — that a stolen password alone cannot satisfy.

What makes this case instructive is not that a door existed, but that this particular door had been left with only one lock while the rest of a large enterprise presumably had more. Attackers do not attack the front entrance you hardened; they enumerate every exposed service and walk through the weakest one. A single remote portal without MFA is enough to make all the other controls moot.

The control that would have stopped it

The control is neither exotic nor expensive: multi-factor authentication on every remote entry point — no exceptions, no forgotten portals. The load-bearing word is every. MFA on the VPN but not the Citrix gateway, or on the new system but not the legacy one, leaves exactly the kind of gap that was exploited here. An MFA program is only as strong as its least-covered door, so the work is as much inventory and coverage as it is technology: enumerate every internet-facing authentication surface and confirm each one enforces a second factor.

Two defenses sit behind MFA as depth. Network segmentation ensures that a single foothold cannot reach everything — if the compromised account can only touch a small zone, lateral movement stalls and ransomware cannot fan out across the whole estate. Tested recovery — real, rehearsed, offline-capable backups with a measured restore time — is what turns a weeks-long outage into hours. Segmentation shrinks the blast radius before the fact; tested recovery shrinks the downtime after it. MFA is the door; these two decide how far the damage travels and how long it lasts.

The blast radius

The documented impact was national in scope. With claims processing and pharmacy systems offline, pharmacies across the country could not process prescriptions and providers could not file claims or get paid; the disruption to United States healthcare persisted for weeks. A ransom of roughly $22 million was reportedly paid. The through-line is proportion: a single remote portal missing a single control cascaded into a nationwide disruption of an essential service — the definition of a systemic single point of failure realized at scale.

See it

The failure and its fixes, in one line:

flowchart LR
    A["One remote portal,<br/>no M.F.A."] --> B["Stolen password<br/>= full access"]
    B --> C["Lateral movement<br/>across the network"]
    C --> D["Nationwide outage,<br/>weeks long"]
    A -.-> E["Fix: M.F.A. everywhere"]
    C -.-> F["Fix: segmentation"]
    D -.-> G["Fix: tested recovery"]

The lesson

One remote door without MFA can cost you the whole network.

Where it rhymes

This is OWASP A07:2021 — Identification and Authentication Failures playing out at national scale: single-factor authentication on an internet-facing service, exactly the weakness that category names. In MITRE ATT&CK terms it maps to Valid Accounts (T1078) used against External Remote Services (T1133) — legitimate credentials on an exposed remote portal, no exploit required. The defensive reflex is the oldest one in the book made concrete: MFA everywhere, treated as a coverage problem across every remote entry point, not a box ticked on the main VPN and forgotten on the portal nobody remembered.

Named concepts: multi-factor authentication, remote-access hardening, network segmentation, tested recovery.