The $22 Million Double-Cross: Change Healthcare and the ALPHV Exit Scam

The pharmacist at a small independent pharmacy in rural Tennessee tried the claim again. The screen returned the same error: the network connection to the insurance clearinghouse was unavailable. She looked at the line of customers — elderly patients who drove forty minutes to fill prescriptions for insulin, blood pressure medication, chemotherapy support drugs — and tried to explain what she didn’t yet fully understand.

“Our systems are down. We’re working on it.”

By the time she said it, on the morning of February 21, 2024, the systems weren’t just down at her pharmacy. They were down at approximately 67,000 pharmacies across the United States. Down at hospitals trying to verify insurance coverage before surgeries. Down at physicians’ offices trying to submit bills. Down at laboratories seeking prior authorizations. Every point in the American healthcare economy that depended on a single, nearly invisible company called Change Healthcare had gone dark simultaneously.

Change Healthcare had been attacked. The attackers had been inside the network for nine days. And they had brought 6 terabytes of data — the medical records, Social Security numbers, and personal details of an estimated 100 million Americans — when they left.

What Change Healthcare Actually Is

Most Americans have never heard of Change Healthcare. The company is infrastructure, not a consumer brand. But in February 2024, Americans learned it was processing their most sensitive medical information and sitting at the center of nearly every financial transaction in the US healthcare system.

Change Healthcare, a subsidiary of UnitedHealth Group’s Optum division (acquired in 2022), is the dominant healthcare clearinghouse between providers and insurance companies. When a doctor sees a patient, the claim must travel from the practice’s software to the insurance company’s adjudication system — two systems speaking different technical dialects that require translation. Change Healthcare does that translation. The company’s own materials cited the figure that made its compromise so terrifying: 15 billion healthcare transactions per year, representing roughly one-third of all US patient records passing through its systems.

The company connected 900,000 physicians, 33,000 pharmacies, 5,500 hospitals, and 600 laboratories to their respective insurance payers. When Change Healthcare went dark on February 21, 2024, all of those connections went dark with it.

Threat Actor Profile: ALPHV/BlackCat

Designation: ALPHV (also known as BlackCat); operates as Ransomware-as-a-Service (RaaS)
Attribution: Russian-speaking RaaS operation; assessed by FBI and Western intelligence agencies as operating primarily from Russia and former Soviet states; believed by researchers to be an evolution of DarkSide (Colonial Pipeline, 2021), rebranded as BlackMatter then ALPHV/BlackCat
Primary Mission: Ransomware deployment for financial gain; provides infrastructure, malware, and negotiation services to “affiliates” who conduct actual intrusions
Known Tradecraft: Credential-based initial access (VPN, Citrix, RDP), extended dwell time for reconnaissance and data exfiltration before ransomware deployment, double-extortion, targeting of high-impact critical infrastructure

Notorious Operations:

• MGM Resorts (September 2023): ALPHV affiliate Scattered Spider (UNC3944) social-engineered MGM’s IT help desk to deploy BlackCat ransomware across casino and hotel systems — $100M+ in losses, weeks of disruption.
• Caesars Entertainment (September 2023): Same affiliate group; Caesars quietly paid a reported $15M ransom within days, avoiding MGM’s extended outage.
• Lehigh Valley Health Network (2023): ALPHV published nude photographs of cancer patients after the network refused to pay — deliberate escalation to maximize pressure.

The Attack: Nine Days in the Dark

The entry vector is one security professionals will study for years — not because it was sophisticated, but because it was grotesquely simple.

In early February 2024, an attacker using stolen credentials connected to Change Healthcare’s Citrix remote access portal. The portal was protected by a username and password. That was all. There was no multi-factor authentication (MFA) — no second factor, no text message code, no authenticator app push.

UnitedHealth Group CEO Andrew Witty would later confirm this to the US Senate, in testimony that produced a quietly devastating moment. A senator asked directly whether MFA had been enabled on the compromised Citrix portal. Witty’s eventual answer: it had not been enabled on that specific portal.

How the credentials were obtained is not publicly confirmed. Consistent with ALPHV’s historical tradecraft, they were likely purchased from an initial access broker — a criminal specializing in obtaining corporate credentials via phishing or credential stuffing — possibly for a few hundred dollars on a dark web forum. The damage they enabled exceeded $22 billion in UnitedHealth Group market capitalization losses in the weeks that followed.

The attackers entered the network and did not immediately deploy ransomware. Instead, they spent nine days inside Change Healthcare’s infrastructure — moving laterally, escalating privileges, identifying critical systems, mapping data stores, and exfiltrating. Over those nine days, the attackers extracted an estimated 6 terabytes of data: health insurance member information, claims data, payment information, patient medical records, dental records, vision records, prescription data, and — for millions of individuals — Social Security numbers. The US Department of Health and Human Services ultimately confirmed approximately 100 million Americans had information exposed — the largest healthcare data breach in US history.

On February 21, 2024, ALPHV deployed its BlackCat ransomware across Change Healthcare’s systems. Change Healthcare’s technology team immediately severed connections to every external network, attempting to contain the blast radius. The result: Change Healthcare’s entire network — every connection, every API, every data feed — went simultaneously dark.

The Shutdown: When the Healthcare Economy Stops

Pharmacies were the first and most visible point of failure. Prescription processing runs through a clearinghouse to verify insurance coverage before dispensing. When Change Healthcare disconnected, pharmacies lost the ability to submit real-time insurance claims. Patients were suddenly told the out-of-pocket cost — often hundreds or thousands of dollars. Pharmacies that couldn’t afford to dispense without payment confirmation began turning patients away.

Hospitals faced a different crisis: without the ability to verify insurance coverage, they faced a choice between proceeding without guaranteed payment or postponing procedures. Independent physician practices — small offices with thin margins and payroll due monthly — couldn’t submit claims and began reporting they couldn’t make payroll within weeks.

UnitedHealth Group responded with an emergency program advancing $3.3 billion in loans to healthcare providers to prevent the healthcare economy from collapsing. Full service restoration took months.

The Ransom Payment and the Exit Scam

In early March 2024, UnitedHealth Group paid a ransom of $22 million in Bitcoin to ALPHV/BlackCat. The payment wasn’t publicly confirmed at the time — it emerged through blockchain analysis of known ALPHV cryptocurrency wallets, later confirmed to Congress by the company.

The $22 million was paid to stop publication of the 6 terabytes of stolen data. In ransomware economics, this should have concluded the engagement: ALPHV received payment, honored the agreement, moved on.

What happened instead is one of the most remarkable episodes in the history of ransomware.

ALPHV took the $22 million — and then disappeared.

The group’s dark web infrastructure — negotiation portals, leak site, administrative panels — went offline in the first week of March. ALPHV published a fake notice claiming law enforcement seizure. It was quickly identified as fabricated — cover for what the criminal underground calls an exit scam.

ALPHV had collected $22 million from Change Healthcare, pocketed the entirety of it, and shut down — without paying their affiliate. In the RaaS model, the affiliate who conducts the intrusion is supposed to receive 60–70% of the ransom. ALPHV kept 100%.

The affiliate — operating under the name Notchy in underground forums — had done the work, taken the legal risk, spent weeks inside one of the most sensitive networks in the United States, and received nothing.

The Second Threat: RansomHub and the Affiliate’s Revenge

Within days of ALPHV’s disappearance, RansomHub — a newer ransomware group recruiting disaffected affiliates from disrupted operations — announced they had obtained the 6 terabytes of Change Healthcare data and would publish it unless paid. The defrauded affiliate had taken the stolen data to a new group and launched a second extortion campaign.

RansomHub began publishing samples of the stolen data as proof of possession: insurance cards, medical records, prescription information, and personal details of identifiable individuals. Change Healthcare confirmed the breach publicly in April 2024, acknowledging it was “likely to affect a substantial proportion of people in America.”

The double-extortion from two separate criminal entities for the same data — a scenario ransomware attorneys had theorized but never seen at this scale — became a defining case study of 2024 ransomware economics.

Congressional Hearings: The MFA Accountability Moment

On May 1, 2024, Andrew Witty appeared before the Senate Finance Committee and the House Energy and Commerce Committee. The hearings were notable for bipartisan ferocity. Senator Ron Wyden (D-OR) asked directly whether Change Healthcare had MFA on the compromised Citrix portal. Witty’s qualified answer — that it had not been fully implemented on that specific portal — landed with the weight of a confession.

Here was the CEO of the largest health insurance company in the US confirming that a $22 million ransomware attack on the US healthcare system had succeeded because of the absence of a security control that cybersecurity professionals had recommended as baseline since the early 2010s. The same MFA failure had enabled the Colonial Pipeline breach in 2021. The same pattern had appeared in dozens of high-profile breaches.

Witty also confirmed the ransom payment:

“I know that’s a difficult position to understand. We made the decision to pay the ransom in order to do our best to protect patient data.”

Whether any of the 6 terabytes was actually deleted remains unverified. Data, once stolen, cannot be un-stolen.

Legacy: HIPAA Reform and the Clearinghouse Problem

The Change Healthcare attack triggered the most significant regulatory response to a healthcare cybersecurity incident since HIPAA was enacted. HHS announced updates to HIPAA Security Rule requirements — specifically strengthening provisions around access controls, MFA, and network segmentation. The existing HIPAA Security Rule had been largely static since 2003.

The clearinghouse model itself came under scrutiny. Change Healthcare’s position as the dominant single processor of US healthcare transactions — the result of decades of consolidation — had created exactly the single point of failure that critical infrastructure security theory predicts will be exploited. The American Hospital Association called for UnitedHealth Group to be held accountable. Small practices and independent pharmacies sought legal and regulatory remedies.

The total financial impact on UnitedHealth Group was staggering: $872 million in direct costs in Q1 2024 alone, with full-year estimates exceeding $2 billion. The company’s stock lost more than $40 billion in market capitalization in the weeks following the attack.

ALPHV’s core developers are believed to have retired on the proceeds. No arrests have been made. The affiliate who broke into Change Healthcare remains unknown and at large. The 100 million Americans whose medical records were stolen have been offered credit monitoring. The records themselves are presumed to be in criminal hands indefinitely.

---

Attack Chain: Change Healthcare ALPHV/BlackCat Intrusion

graph TD
    A["Credential Acquisition\nStolen Citrix portal credentials\npurchased from initial access broker\nor obtained via phishing/infostealer"] --> B["Initial Access\nLogin to Change Healthcare\nCitrix portal — single factor only\nNo MFA enabled — Feb ~12, 2024"]
    B --> C["9-Day Dwell Period\nLateral movement through network\nPrivilege escalation\nActive Directory enumeration"]
    C --> D["Data Exfiltration\n6TB stolen:\nInsurance data, medical records,\nSSNs for ~100M Americans"]
    D --> E["Ransomware Deployment\nBlackCat ransomware detonated\nFeb 21, 2024\nAll Change Healthcare systems encrypted"]
    E --> F["Emergency Shutdown\nChange Healthcare severs all\nexternal network connections\nUS healthcare payment system halts"]
    F --> G["National Healthcare Crisis\n67,000 pharmacies affected\nHospitals can't verify insurance\nPhysicians miss payroll\nUHG advances $3.3B in emergency loans"]
    G --> H["Ransom Negotiation\nUHG pays $22M Bitcoin\nto ALPHV — March 2024"]
    H --> I["ALPHV Exit Scam\nGroup fakes law enforcement seizure\nKeeps $22M — pays affiliate nothing\nDisappears from dark web"]
    I --> J["Second Extortion\nDefrauded affiliate takes data\nto RansomHub — demands second payment\nBegins publishing data samples"]
    J --> K["Congressional Testimony\nCEO Andrew Witty confirms MFA failure\nConfirms ransom payment\nMay 1, 2024"]
    K --> L["Legacy\nHIPAA Security Rule reform\n$872M+ direct UHG costs\nLargest healthcare breach in US history"]

    style A fill:#1a1a2e,color:#e0e0e0
    style B fill:#c0392b,color:#fff
    style E fill:#c0392b,color:#fff
    style I fill:#8e44ad,color:#fff
    style J fill:#8e44ad,color:#fff
    style L fill:#2c3e50,color:#e0e0e0