The missing sign-in step that stalled US health care payments

The story

Change Healthcare, part of UnitedHealth Group, processes medical claims and payments for a large share of the US health care system. On February 21, 2024, ransomware shut down its systems.

The effects reached across the country. Pharmacies had trouble processing insurance claims, and some patients paid for medication out of pocket. Doctors’ offices and hospitals could not get paid, and some smaller practices struggled to stay open.

In testimony to Congress in May 2024, UnitedHealth’s CEO explained how it began. The attackers logged in on February 12 through a remote access portal that did not require multi-factor authentication. They spent nine days moving through the network and taking data before starting the ransomware. Data on about 190 million people was affected.

Why it mattered

It showed how much of an industry can depend on a single company. Electronic claims and payments were blocked across the country, some providers were at risk of going out of business, and data on about 190 million people was affected. Researchers raised concerns about how concentrated the health care payment system had become.

The lesson today

The way in was a login that asked only for a password. Any account that can be reached from the internet, especially remote access, needs a second sign-in step. It is one of the simplest protections there is, and one of the most important.