Change Healthcare ransomware disrupted U.S. claims and payment infrastructure

On 21 February 2024, ALPHV/BlackCat deployed ransomware inside Change Healthcare after criminals had used compromised credentials to access a Citrix portal and exfiltrate data. Change Healthcare severed connectivity and shut down affected environments, making claims, pharmacy and payment services unavailable or degraded. The outage propagated across the U.S. healthcare sector, causing claims backlogs, payment delays and significant cash-flow disruption for providers. UnitedHealth later reported USD 3.09 billion in 2024 direct-response and business-disruption impacts from the cyberattack.