The Change Healthcare Ransomware Attack — When One Claims Hub Stopped

One Company Through Which Claims Pass

This article is written about an event that occurred in the United States in 2024. Hospitals, clinics, and pharmacies in the United States see patients and then submit those costs to private or government insurance to get paid. According to an analysis from 2023, before the incident, claims between private insurers and providers exceeded 9 billion per year, and it took an average of 4 to 6 weeks for a single claim to be processed and money to come in (PMID 38756977). Between hospitals and insurers, there are companies that take these claims and pass them along. A claims clearinghouse is a company that receives and delivers claims submitted by hospitals and clinics to insurers, payment details returned by insurers, and requests for pre-insurance eligibility verification and prior authorization before treatment. In February 2024, one such company was stopped by a ransomware attack.

That company is Change Healthcare. UnitedHealth Group (UHG), an American health insurance and medical services corporation, acquired it at the end of 2022 (Senate Finance Committee Hearing Record), and UHG itself explains that it is now part of UHG's Optum, a company that lets information, claims, and payments flow between doctors, pharmacists, insurers, and the government (UHG CEO Congressional Testimony).

Scale is measured with different rulers across documents. The American Hospital Association (AHA), an industry group for hospitals, noted that this company handles insurance eligibility verification, pharmacy operations, claims transmission, and payments, touching 1 in 3 patient records (American Hospital Association Survey). A brief from the Department of the Treasury's Office of Financial Research (OFR), citing estimates from the hospital association letter, noted that the company handles $2 trillion in claims per year, estimated at 44% of U.S. healthcare funding in 2024 (Department of Financial Research Brief).

UHG, the party involved, stated that the payment processing done directly by Change Healthcare is about 6% of total payments (UHG CEO Congressional Testimony). The 44% is an estimate of claim funds passing through Change, while 6% is the share of payments processed directly by Change, so the two numbers count different things. The Financial Research Brief also relays words from Change Healthcare itself, cited in legal documents from the U.S. Department of Justice. The statement says that the healthcare system where insurers and medical providers transact cannot function without Change Healthcare (Department of Financial Research Brief). Measured by transaction count or claim amount, a large share of the path where U.S. medical expenses flow was passing through a single company.

Public documents recording this event split into four natures. Party documents include UHG securities authority disclosures and quarterly reports, as well as testimony submitted to Congress on May 1, 2024, by UHG Chief Executive Officer Andrew Witty. Congressional documents include the record of that day's Senate Finance Committee hearing, statements and letters from Senate Finance Committee Chairman Ron Wyden, a report by the Congressional Research Service (CRS), a nonpartisan agency, and a memo from House committee staff. Wyden's words are arguments from a critical lawmaker. Government documents include the Financial Research Brief (which states that it represents the author's views), materials from the U.S. Department of Health and Human Services Office for Civil Rights (OCR), press releases and joint advisories from the Centers for Medicare & Medicaid Services (CMS), and lastly, surveys and reports from the victimized industry association, the Hospital Association.

Over the Course of Nine Days

The previous scene is from December 2023. According to the Congressional Research Service, that month the U.S. Department of Justice announced it had disrupted the operations of the ransomware group BlackCat/ALPHV, and that group declared it would retaliate against the United States by targeting healthcare providers, rebuilding its infrastructure within two months to compromise Change Healthcare (Congressional Research Service report). A joint advisory by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Health and Human Services noted that among nearly 70 victims whose data the group leaked since mid-December 2023, the healthcare sector was the largest, likely reflecting a reaction to a post by the group's administrator after the disruption operation encouraging the targeting of hospitals. The advisory does not name Change Healthcare explicitly (FBI, CISA, and HHS joint advisory).

The intrusion began through a door leading in from outside the company. Remote access is a method of using a computer inside the company from outside over the internet, and a remote access portal is the door that greets people coming in that way. According to Witty's written testimony, on February 12, 2024, criminals entered Change Healthcare's remote access portal using stolen login credentials. That portal did not have multi-factor authentication (UHG CEO congressional testimony). Multi-factor authentication, as seen in "Passwords and Passkeys — How Do You Prove You Are You?", is a method that requires two or more different types of evidence among things you know, things you have, and body characteristics. This means it was a door that could be opened by holding just someone else's single key. Witty attached the caveat "our understanding may change as we learn more" to this explanation (UHG CEO congressional testimony).

According to the same testimony, the intruders moved around inside the system to extract data, and the ransomware was executed nine days later. Ransomware is malicious code that renders files unusable—such as by encrypting them—and then demands money in exchange for releasing them, as defined in "Phishing and Social Engineering — Ringing the Doorbell Instead of Breaking the Lock". In Witty's words, on the morning of February 21, criminals calling themselves ALPHV or BlackCat executed ransomware inside Change Healthcare and encrypted the systems, leaving the company unable to access its own systems (UHG CEO congressional testimony).

At the time, the company did not know the entry point of the intrusion, so it immediately severed connections with Change's data centers to eliminate the possibility of the infection spreading further. Witty stated that taking down numerous environments caused extreme disruption but was the right thing to do, and maintained that there was never any evidence of the infection spreading outside of Change (UHG CEO congressional testimony). In a securities filing with the same incident date, UHG stated that a threat actor "suspected to be nation-state affiliated" had accessed some systems, and wrote that the duration and scope of the disruption could not be estimated at the time (UHG filing).

When the connection was cut, the path through which claims passed was cut off along with it. A letter from Chairman Wyden stated that UHG chose to take down the systems and rebuild them from scratch, resulting in a total shutdown of company services, with some revived within weeks but others halted for over two months (Chairman Wyden letter). According to the involved party's explanation, they replaced thousands of laptops and rebuilt data center networks and core services, creating a new environment in "just weeks" that would normally take months (UHG CEO congressional testimony).

Stopped Claims, Blocked Prescriptions

What stopped were money and prescriptions. The Congressional Research Service noted people who could not use insurance for prescriptions and pharmacies whose cash flow dried up as payments froze (Congressional Research Service Report). According to a Financial Research Office brief, during the outage many hospitals, doctors, and pharmacies that used Change Healthcare could neither submit claims nor receive payments. The brief called that result the "healthcare liquidity crisis," meaning a situation where medical institutions ran out of cash to use immediately. That financial pressure in some cases led to closures or sales to other operators (Department of the Treasury Financial Research Office Brief).

A survey of roughly 1,000 member hospitals conducted by the American Hospital Association from March 9 to 12 is self-reported. In it, 94% reported financial impacts, 82% reported cash flow impacts, and among those 82%, over 33% said more than half of their revenue was impacted (American Hospital Association Survey). The 33% is a proportion within the hospitals that reported cash flow impacts, so it is smaller when calculated across all responding hospitals. In the same survey, 74% answered that there was a direct impact on patient care (American Hospital Association Survey).

There are also numbers counted from claim records. Citing data from the revenue management data firm Kodiak Solutions, the hospital association report noted that in just the first three weeks after the attack, claim submissions by the firm's clients—1,850 hospitals and 250,000 doctors—dropped by 6.3 billion dollars (American Hospital Association Report). This is a number that the report secondarily transferred from an industry company's data.

The circumstances of smaller places remain in words. In his hearing remarks, Chairman Wyden said that small providers, especially mental health providers, were putting paper claims into envelopes, that prescriptions were going unfilled, and that patients stayed in hospitals longer than necessary (Chairman Wyden Hearing Remarks). This is the chairman's remark, and no figures are attached.

Recovery varied in speed depending on the function. The involved party UHG revived pharmacies first, so that by March 7, 99% of pre-incident pharmacies were able to process claims, and as of May 1, Change Healthcare's payment processing was roughly 86% of pre-incident levels (UHG CEO Congressional Testimony). The Financial Research Office brief noted that as of August 30, 2024, Change Healthcare was still restoring some services (Department of the Treasury Financial Research Office Brief). According to the explanations of the involved party, pharmacies were able to process almost all claims within a few weeks, but even after half a year, some services had not returned completely.

22 Million Dollars

Witty wrote in his written testimony that the decision to pay the ransom was his own as chief executive, and that it was one of the hardest decisions he had ever made in his life (UHG CEO Congressional Testimony). The written testimony contains no amount.

The amount first circulated through reports. A House Energy and Commerce Committee majority staff memo dated April 16th noted that while there were reports UHG had paid 22 million dollars, UHG had not confirmed whether it made the payment (House Energy and Commerce Committee Memo). The setting where the party involved directly confirmed the amount was the Senate Finance Committee hearing on May 1st, 2024. When asked if he had paid the ransom, Witty answered yes, and when asked how much it was, he answered "22 million dollars." His written response to questions stated that the demanded 22 million dollars was paid in bitcoin (Senate Finance Committee Hearing Record).

The American Hospital Association report interpreted the logic of the ransom by connecting it to the structure of this incident. Criminals chose a strategy of piercing a single external company at the center like a wheel axle, reaching all thousands of healthcare organization customers relying on it, and the wider and more severe the damage, the larger the ransom they could demand and the greater the likelihood that victims would pay (American Hospital Association Report). This is the interpretation of an affected industry trade group.

There is research measuring what determines whether to pay a ransom or not using data from another country. Among 382 ransomware attacks reported to the Dutch police or handled by incident response companies, whether backups existed and whether an incident response company was called played major roles in deciding whether to pay the ransom. Having insurance made the ransom paid 2.8 times larger, and cases where data was exfiltrated made it 5.5 times larger (DOI: 10.1109/ecrime61234.2023.10485506). These multipliers come from different attacks in another country, so they cannot serve as numbers explaining this particular ransom.

The incentive that ransom payment gives to the attack as a whole is a different matter. The authors of a study interviewing cyber insurance industry insiders concluded that while cyber insurance helped insured companies in the short term by funding ransom payments and speeding up processing, it weakened security in the long term. Funding ransoms encouraged more attacks, and as companies increased their resilience, criminals adapted, raising ransoms to the point where even the viability of insurance is being questioned. The authors wrote that because of the intense market competition, insurance companies turned their eyes toward the government instead of attaching strict enrollment conditions (DOI: 10.1057/s41288-022-00281-7). In her book, a historian of cyber insurance, Josephine Wolff, argues that insurance normalizes online ransom payments, running counter to the security goal of reducing ransomware's profitability (DOI: 10.7551/mitpress/13665.001.0001). Neither of these studies measured this specific incident; they are diagnoses of ransom payments in general.

A Door with Only One Lock

Different documents offer different explanations for why the door was in that state. We look at the parties involved first. Asked at the May 1 hearing whether he knew that multi-factor authentication was not required across the entire company, Witty replied, "Our policy is to place multi-factor authentication on systems exposed to the outside." He said they were in the middle of upgrading the acquired technology and that there was a server inside that was not protected by multi-factor authentication, and when asked if he knew that server lacked multi-factor authentication, he answered, "Not at all." His written responses stated that the server in question was an old Change Healthcare server and that they were in the process of bringing it into compliance with UHG standards (Senate Finance Committee Hearing Record). The conclusion from the party involved is that the policy existed and that one acquired old server had not yet been brought into line with that policy.

Chair Wyden’s explanation is different. At the same hearing, the chairman claimed that this hack could have been prevented with multi-factor authentication, which is a "cybersecurity basic" (Senate Finance Committee Hearing Record). In a May 30 letter requesting an investigation by the U.S. Federal Trade Commission (FTC) and the U.S. Securities and Exchange Commission (SEC), he wrote that this incident was "entirely preventable and the direct result of corporate negligence." The letter noted that Witty had testified earlier that day in the House that compensating controls could be placed on older technology, and interpreted that to mean UHG’s policy did not actually require multi-factor authentication for all external servers (Wyden Letter). The original transcript of the House testimony was not verified by this article, and that passage remains only in the form cited by the letter.

The letter goes further than multi-factor authentication. It wrote that the breach of a single remote access server should not have escalated into an infection severe enough to require rebuilding the digital foundation from scratch, and it presumed that failing to require multi-factor authentication was likely not the company's only security flaw. Regarding accountability, it wrote that making a single chief security officer a scapegoat is unfair and that the chief executive officer and the board of directors should bear responsibility (Wyden Letter).

The authors of the Office of Financial Research brief looked at the recovery side. They wrote that Change Healthcare lacked a recovery plan with well-practiced procedures to reduce downtime, and that a history of growing through acquisitions may have contributed to this vulnerability. They also wrote that backups existed but were not properly separated from the compromised network and were thus affected together (Office of Financial Research Brief). The written responses from the party involved tell a different story. They stated that UHG systems overall had substantial emergency and backup infrastructure in place even before the incident, and that they restored services after the incident using backups from a date prior to the event (Senate Finance Committee Hearing Record). Whether the two statements directly contradict each other cannot be determined from public documents alone.

Both the party involved and Chairman Wyden cite a server without multi-factor authentication as the starting point, but documents differ in explaining why that server was in that state and why that single server snowballed into a total rebuild. The Congressional Research Service pointed elsewhere. It wrote that since ransomware attacks are common, the incident itself might not seem surprising, and that what stands out is the targeted company and the impact it had on the entire ecosystem (Congressional Research Service Report).

The terms used to refer to the attacker also changed depending on the document and the date. The February 21 disclosure wrote "a suspected nation-state-affiliated threat actor" (UHG Disclosure), Witty's May 1 testimony wrote "criminals who called themselves ALPHV or BlackCat" (UHG CEO Congressional Testimony), and all subsequent quarterly reports simply wrote "cybercrime threat actors" (UHG Quarterly Reports). Among external documents, the Congressional Research Service wrote that BlackCat/ALPHV, a Russia-linked cybercrime group, claimed responsibility (Congressional Research Service Report), and a House memo wrote that there were reports of this group being responsible while adding that the Department of Justice describes the group as a Russia-based ransomware gang (House Energy and Commerce Committee Memo). The most definitive expression is the American Hospital Association report's "attack by the Russian ransomware gang ALPHV BlackCat" (American Hospital Association Report). None of the documents reviewed by this article officially conclude that it was the work of a state, and "nation-state-affiliated" was merely an "suspicion" attached in the first day's disclosure.

Why Stopping in One Place Stopped Things Widely

Could insurers route money another way if Change Healthcare stopped? According to the Office of Financial Research brief, some insurers lacked backup payment systems and depended entirely on Change. Contracts also locked in that dependence. An exclusivity clause is a contract clause that binds a trading partner not to give the same work to another company. Change had such exclusivity clauses in contracts with over a third of its customers, and because of this, insurers that received claims only through Change could not be connected to another clearinghouse. The exclusivity clauses were later waived, but the brief noted that switching claims clearinghouses itself was expensive and took a long time (Office of Financial Research brief). In the American Hospital Association survey, 67% of hospitals also answered that switching claims clearinghouses was "difficult or very difficult" (American Hospital Association survey).

Chairman Wyden put the same point more strongly. Even though Change's systems stopped for weeks, exclusive contracts prevented over a third of providers from switching clearinghouses, which likely dragged out the aftermath of the hack (Wyden Hearing Statement). The brief wrote this one-third as the proportion of customers bound by exclusivity clauses, and the chairman as the proportion of providers that could not switch. The brief cites the chairman's remarks and media reports as the source for this part. Because the same one-third has changed into words counting different things in each document, the two sentences are not read merged into one. The "1 in 3 patient records" seen earlier and "about 34% of loans" seen later also count different things each.

Concentration risk is the risk that because many institutions depend on a single supplier, if that one stops, everyone can stop together. The Office of Financial Research brief wrote that if core operational functions depend on only one or two suppliers, the risk of wide disruption grows when one of them collapses (Office of Financial Research brief). A single point of failure is a spot where if only that one place stops, the whole thing stops. Citing features like the earlier $2 trillion and 44%, the brief considered Change Healthcare's scale comparable to financial market infrastructures through which many financial transactions pass, making the company a potential single point of failure for the healthcare system (Office of Financial Research brief).

The American Hospital Association report pointed out where the concentration came from. It wrote that mergers brought services on which the entire healthcare system depends into one place, and as institutions came to depend excessively on that service, risk gathered in one place. Most healthcare institutions' risk management programs failed to identify dependence on UHG/Change as a mission-critical single point of failure (American Hospital Association report). This report is a piece by an industry association that openly states its critical stance toward UHG. A viewpoint article published in the medical journal JAMA Health Forum also addressed concerns over integration and acquisitions of healthcare companies in light of this incident (PMID 39302668, viewpoint article).

The Office of Financial Research brief noted that while leaving core functions to more than one or two suppliers could reduce the risk of wide disruption, a lack of interoperability for systems to work together often makes having multiple suppliers difficult in practice (Office of Financial Research brief). There is also a force pushing toward centralization. The earlier 2023 analysis named the introduction of a centralized automated claims clearing window as one of the interventions that could save $40 billion to $60 billion a year (PMID 38756977). Proposals to centralize for efficiency and warnings about risks concentrated in one place stand side by side regarding the same claims system.

The documents explain that the reason such wide claims stopped together when one company stopped was that many institutions depended without alternatives on that single company and had difficulty switching to another path.

Research views this spread through a broader framework. A 2022 modeling study divided cyber risks spreading along interdependent systems into cascading failures, common-cause failures, and independent failures, and presented a model estimating how large losses from a single company's incident spread along inter-industry transactions (PMID 33594708). In a qualitative case study of seven supply chain cyberattacks across multiple sectors including retail, logistics, energy, and healthcare, attacks mostly started from connections with external vendors, and a breach in one place spread into paralysis of the entire system along structures where operations were interlocked (PMID 42172193).

The Money That Was Advanced Had to Be Paid Back

Two organizations released funds to plug the blocked money. According to Witty's written testimony, UHG routed volume to competing claims-clearing companies, UnitedHealthcare advanced over $1 billion in claims payments, and opened a temporary funding program issuing interest-free, fee-free loans (UHG CEO Congressional Testimony). An advance payment is money pulled forward from future payouts and taken back out of later incoming payments. UHG stated that as of April 26, it had issued over $6.5 billion in advance payments and loans to thousands of providers, with about 34% of the loans going to safety-net hospitals and federally qualified health centers. Witty acknowledged that because he could not see providers' claims flows, some initial estimates failed to cover all needs and were adjusted quickly (UHG CEO Congressional Testimony).

On the government side, it was CMS. Medicare is a U.S. public insurance program primarily for adults aged 65 and older. CMS announced on June 17, 2024, that its Medicare advance payment program, started in early March, had issued over $2.55 billion to Part A providers like hospitals and over $717.18 million to Part B suppliers. The same announcement stated that over 96% had already been recovered (CMS Press Release).

Both UHG's money and CMS's money had to be paid back. UHG's money was advance payments and interest-free loans, and CMS had already gotten back over 96% by mid-June.

How much of the gap was plugged was calculated in a Financial Research Office brief. The $9.7 billion, adding CMS's over $3.2 billion (March 9 to June 17) and UHG's $6.5 billion (up to April 30), was about 2.6% of the roughly $375 billion in claims Change usually processes in a quarter. The brief noted that the support was likely insufficient, especially for smaller providers running short on cash, while larger hospitals with typically 4 to 10 months of cash reserves were better off. In an American Medical Association (AMA) survey cited by the brief, 55% of physicians covered clinic expenses out of pocket during the outage. Smaller providers like medical practices had low cash reserves and had to pay payroll and supply bills with the missing money, so they likely shook significantly, the brief wrote (Office of Financial Research Brief).

Whether the support funds went where they were actually needed is examined by a study that directly measured this incident. A study published in 2025 in the U.S. health policy journal Health Affairs analyzed the $3.3 billion distributed by CMS to providers who suffered revenue disruptions after the incident, of which $2.2 billion went to hospitals. The authors concluded that because the design gave funds only to those who applied and in the same way to everyone, two things happened together: overpayment occurred at many participating hospitals, and many hospitals likely to have suffered disruptions from the attack did not participate (PMID 41329887). Because the calculation method for the $3.3 billion and $2.2 billion figures in this paper is not stated in the abstract of the CMS press release, they are not combined into a single number. This means that places with leftover money and places the money failed to reach were in the same program together.

The Financial Research Office brief estimated that most of the business losses would not be covered by any insurance. Credit rating agency S&P saw no material impact on UHG's credit rating, and the brief wrote that the financial blow of this incident could be greater for other operators than for Change Healthcare itself (Office of Financial Research Brief).

UHG's own costs are in its quarterly report. For the nine months ended September 30, 2024, direct response costs totaled $1.7 billion, and business disruption was estimated at $747 million. The report noted that these costs would continue into 2025 on a smaller scale (UHG Quarterly Report).

How Many People's Information Was It?

The data that leaked contained people's information. Testimony on May 1st stated that an initial sample investigation found files containing protected health information and personally identifiable information, and that this could correspond to a "significant portion" of Americans. It stated that no evidence had yet been seen that medical records or entire medical histories had leaked (UHG CEO congressional testimony).

The numbers changed from day to day. According to data from the Office for Civil Rights, which enforces medical privacy regulations, Change Healthcare wrote 500 people in the "approximate number of individuals affected" box on its July 19, 2024 breach report. 500 is the minimum threshold for posting on the Department of Health and Human Services breach portal, and the actual number was under review. Later, Change Healthcare announced that it had sent about 100 million individual notices on October 22, 2024, and announced that about 190 million people on January 24, 2025, and about 192.7 million people on July 31, 2025, had been affected (HHS Office for Civil Rights FAQ). A notice is a breach notification as seen in "The Equifax Breach — After the Theft of Data No One Chose to Hand Over", which is the act of a company whose personal information leaked informing the owners of that information of the fact. The number of notices sent and the number of people affected are different units.

A hospital association report (dated January 2025) stated that on "October 24, 2024," Change Healthcare officially reported that the health information of 100 million Americans had been stolen, and that it was the largest medical information leak in U.S. history (American Hospital Association report). It differs from the Office for Civil Rights data in date (October 22nd and 24th) and expression (number of notices sent versus number of people whose data was stolen), and is the number before it was revised to 190 million people on January 24, 2025. 100 million people is not the final scale of this incident.

Things We Still Don't Know

The final cost is not yet closed. The total after quarterly reports note that costs will continue into 2025 is not in the documents this article reviewed (UHG Quarterly Report).

The magnitude of losses that the support failed to cover is also unknown. The Financial Research Lab brief's estimate is that it was "likely insufficient," and closures or sales are noted only as "in some cases," so the exact number of places is unknown (Treasury Financial Research Lab Brief). Research measuring whether the support funds matched needs looked at CMS money (PMID 41329887), and research measuring how well the UHG loans matched who needed them and by how much is not among the papers this article reviewed.

What happened to patients is even emptier. The American Hospital Association survey's "74% directly impacted patient care" is a hospital's self-report (American Hospital Association Survey), and unfulfilled prescriptions and prolonged admissions are statements made by Chairman Wyden without figures (Chairman Wyden Hearing Testimony). Research measuring what this incident did to patient health is not among the papers this article reviewed. Research measuring what happens to patients when hospitals are directly attacked was covered in "WannaCry and England's Hospitals — A Week at Hospitals That Were Never the Target", but what stopped this time was the path through which hospital funds and prescriptions travel, which differs in path from cases where hospitals themselves were attacked, so those numbers cannot be carried over.

Paths Gathered in One Place

Testimony from those involved indicates that a criminal used someone else's login credentials to enter a remote access portal without multi-factor authentication, and locked the system nine days later. When the company severed the connection, the billing, payments, and prescriptions passing through it stopped together.

The documents trace the scope of this incident to the dependencies crowded behind that door. When the paths of many institutions converge on a single place, the stoppage of that single place can cause many places to stop together. While that path was blocked, the money coming in was money that had to be repaid, and there were places with surpluses and places with shortages.

The recommendations that followed also vary by document. The American Hospital Association recommended having backup procedures to survive at least four weeks without core technology and external vendors, and avoiding exclusivity clauses in service contracts critical to life and operations. The same report noted that government health agencies were unfamiliar with the vast scope of Change's services, and that CMS had limited authority to quickly assist providers (미국병원협회 보고서). Whitty testified that he supports mandatory minimum security standards for the healthcare industry jointly created by the government and the private sector (UHG CEO 의회 증언), and Chairman Wyden argued that the Department of Health and Human Services does not require minimum cybersecurity standards for billing clearinghouses like Change (와이든 위원장 청문회 발언).

What this single day shook is the property that "Security — Unseen by Others, Unchanged in Secret, Open When Needed" calls availability—namely, the property that authorized people can actually use information and systems when needed. This time, that property collapsed beyond a single company, breaking down simultaneously across the billing of countless hospitals, clinics, and pharmacies that relied on that company. How a structure relying on a single such component arises inside software continues in "The Log4j Vulnerability — Who Finds the Part Buried in the Wall?", and the paths that remain even after turning on multi-factor authentication continue in "The Limits of Two-Step Verification — Which Visitors Can Still Open the Second Door?".

Incident Materials

• "Form 8-K, Item 1.05 Material Cybersecurity Incidents" (Incident date 2024-02-21, Signed 2024-02-22) — https://www.sec.gov/Archives/edgar/data/731766/000073176624000045/unh-20240221.htm — Securities and Exchange Commission filing by the party UHG. The first official explanation on the day of the incident ("suspected nation-state association", unable to estimate the scope of disruption).
• "Testimony of Andrew Witty, Chief Executive Officer, UnitedHealth Group" (2024-05-01) — https://www.finance.senate.gov/imo/media/doc/0501_witty_testimony.pdf (House version: https://d1dth6e84htgma.cloudfront.net/Witty_Testimony_OI_Hearing_05_01_24_5ff52a2d11.pdf) — Written testimony by the party's CEO (identical text for Senate and House). Invasion pathways, response, recovery, relief funds, and personal data investigation.
• "Hacking America's Health Care: Assessing the Change Healthcare Cyberattack and What's Next" S. Hrg. 118-785 (Hearing 2024-05-01) — https://www.govinfo.gov/content/pkg/CHRG-118shrg63595/html/CHRG-118shrg63595.htm — Official transcript of the Senate Finance Committee hearing. CEO verbal answers and written Q&A responses (ransom amount, multi-factor authentication policies, backups, acquisition timing) and statements by senators.
• "UnitedHealth Group Form 10-Q" Quarters 1–3 of 2024 (2024-05-08 · 2024-08-09 · 2024-11-04) — https://www.unitedhealthgroup.com/content/dam/UHG/PDF/investors/2024/UNH_Q1-2024_Form-10-Q.pdf — Quarterly reports by the party. Quarterly response costs, business disruptions, cumulative loans, and attacker descriptions.
• "Wyden Hearing Statement on Change Healthcare Cyberattack and UnitedHealth Group's Response" (2024-05-01) — https://www.finance.senate.gov/chairmans-news/wyden-hearing-statement-on-change-healthcare-cyberattack-and-unitedhealth-groups-response — Hearing statement by the Senate Finance Committee Chairman (critical viewpoint). Exclusive contracts, harm to small providers, and the absence of minimum standards.
• Letter of Request for Investigation to the Federal Trade Commission and Securities and Exchange Commission by Chairman Wyden (2024-05-30) — https://www.finance.senate.gov/imo/media/doc/wyden_letter_to_ftc_and_sec_on_uhg_cybersecuritypdf.pdf — Arguments by the Chairman. Full reconstruction and downtime duration, interpretation of multi-factor authentication policies, and CEO and board responsibility.
• "The Change Healthcare Cyberattack and Response Considerations for Policymakers" CRS Insight IN12330 (Revised 2024-04-24) — https://www.congress.gov/crs-product/IN12330 — Congressional Research Service report (bipartisan). BlackCat's retaliation declaration, prescription and pharmacy damages, HHS actions, and attribution descriptions.
• "Examining Health Sector Cybersecurity in the Wake of the Change Healthcare Attack" (2024-04-16) — https://d1dth6e84htgma.cloudfront.net/04_16_2024_HE_Hearing_Public_Memo_1fa6c0b02b.pdf — House Energy and Commerce Committee majority staff hearing background memo. Ransom reports (unverified), reports of demands from a second group.
• "The Cyberattack on Change Healthcare: Lessons for Financial Stability" OFR Brief 24-05 (2024-11-13) — https://www.financialresearch.gov/briefs/files/OFRBrief-24-05-change-healthcare-cyberattack.pdf — Post-incident analysis by the Department of the Treasury's Office of Financial Research (author views). Scale, exclusivity clauses and concentration risk, liquidity crisis, relief fund ratios, and recovery plans and backups.
• "Change Healthcare Cybersecurity Incident Frequently Asked Questions" (Updated 2025-03-14) — https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html — Department of Health and Human Services Office for Civil Rights. Breach reports, notification dates, and number of affected individuals.
• "CMS Preparing to Close Program that Addressed Medicare Funding Issues Resulting from Change Healthcare Cyber-Attack" (2024-06-17) — https://www.cms.gov/newsroom/press-releases/cms-preparing-close-program-addressed-medicare-funding-issues-resulting-change-healthcare-cyber — Centers for Medicare & Medicaid Services press release. Medicare advance payment scale, recovery rate, and closing date.
• "#StopRansomware: ALPHV Blackcat" AA23-353A (First released 2023-12-19, Revised 2024-02-27) — https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a — Joint advisory by the FBI, CISA, and HHS. Circumstances of this group targeting the healthcare sector (Change Healthcare not mentioned).
• "AHA Survey: Change Healthcare Cyberattack Significantly Disrupts Patient Care, Hospitals' Finances" (2024-03-15) — https://www.aha.org/2024-03-15-aha-survey-change-healthcare-cyberattack-significantly-disrupts-patient-care-hospitals-finances — American Hospital Association member survey (roughly 1,000 respondents, March 9–12, self-reported). Impacts on finance, cash flow, and patient care, and difficulties in switching clearinghouses.
• "Change Healthcare Cyberattack Underscores Urgent Need to Strengthen Cyber Preparedness for Individual Health Care Organizations and as a Field" (Dated January 2025) — https://www.aha.org/system/files/media/file/2025/02/Change-Healthcare-Cyberattack-Underscores-Urgent-Need-to-Strengthen-Cyber-Preparedness.pdf — American Hospital Association post-incident lessons report (explicitly critical of UHG). Declining claim submission amounts, concentration risk, description of affected individuals, and recommendations.

Source Papers

• "Lessons From CMS Relief Funding After Cyberattack On Change Healthcare." (2025) — PMID 41329887 — Analysis of the 3.3 billion dollars ($2.2 billion to hospitals) distributed by CMS after the incident. Application-based and uniform designs caused both overpayments to many participating hospitals and non-participation by many hospitals that likely experienced disruptions.
• "Active steps to reduce administrative spending associated with financial transactions in US health care." (2023) — PMID 38756977 — Over 9 billion U.S. claims per year, taking 4 to 6 weeks to process and pay per claim. Introduction of a centralized, automated claims routing window among interventions saving 40 billion to 60 billion dollars.
• "Lessons From the Change Healthcare Ransomware Attack." (2024) — PMID 39302668 — JAMA Health Forum perspective piece. Incident response, concerns over medical company consolidation and acquisition, and cybersecurity priorities.
• "Systemic Cyber Risk and Aggregate Impacts." (2022) — PMID 33594708 — A framework dividing systemic cyber risk into cascading, common-cause, and independent failures, and a model estimating total losses from firm-level incidents using input-output analysis.
• "Cyberattacks in supply chains: A multi-case study." (2026) — PMID 42172193 — Qualitative case analysis of seven supply chain cyberattacks across multiple sectors including retail, logistics, energy, and healthcare. Starting mostly from third-party connections, they spread into systematic paralysis through four mechanisms such as business coupling.
• "Ransomware Economics: A Two-Step Approach To Model Ransom Paid" (2023) — DOI: 10.1109/ecrime61234.2023.10485506 — 382 cases of data from Dutch police and incident response firms. Backups and incident response companies determine whether to pay, while insurance (2.8 times), data leaks (5.5 times), and revenue drive the amount.
• "Insurance and enterprise: cyber insurance for ransomware" (2022) — DOI: 10.1057/s41288-022-00281-7 — Interviews with insurance industry insiders. While helping short-term business activity, ransom payment support encouraged attacks in the long run, and as corporate resilience increased, criminals adapted, raising ransoms and casting doubt on insurability. Insurers relied on governments instead of strict conditions.
• "Cyberinsurance Policy" (2022) — DOI: 10.7551/mitpress/13665.001.0001 — Josephine Wolff's book on cyber insurers. The argument that insurance normalizes ransom payments, working against security goals.