Breach ReportCRITICALBeginner5 min read

Change Healthcare Confirms 100M+ Affected in ALPHV/BlackCat Ransomware Attack

UnitedHealth Group confirmed the Change Healthcare ransomware attack affected over 100 million Americans — the largest healthcare data breach in US history — with full restoration taking nearly a year.

February 15, 2025Verified

HHS OCR Breach Portal UnitedHealth Congressional Testimony

Timeline

February 21, 2024: ALPHV/BlackCat ransomware attack on Change Healthcare
March 2024: UnitedHealth pays $22M ransom; ALPHV exit scams affiliates
April 2024: RansomHub (likely same affiliates) threatens to publish stolen data
October 2024: HHS confirms 100M+ individuals affected notification submitted
February 2025: Full system restoration completed (~12 months post-attack)

Why It Was So Devastating

Change Healthcare processes ~40% of all US medical claims. The attack disrupted:

Prescription processing at 90,000+ pharmacies
Claims submission for thousands of providers
Prior authorization workflows across the US

Small practices had to close. Hospitals lost millions per day in revenue cycle disruption.

Lessons for IT/Security Teams

Single points of failure in third-party integrations are existential risks in healthcare
MFA was not enabled on the Citrix VPN portal used for initial access
Segment healthcare clearinghouse connections from internal networks
Test business continuity plans that assume complete loss of key SaaS/clearinghouse integrations

Healthcare Ransomware Supply Chain

NEWSMEDIUMCVE-2026-17264

Medixant RadiAnt DICOM

Successful exploitation of this vulnerability could allow an attacker to cause the application to crash if a maliciously crafted DICOM file is opened. The following versions of Medixant RadiAnt DICOM are affected: Rad...

WHY IT MATTERS

Successful exploitation of this vulnerability could allow an attacker to cause the application to crash if a maliciously crafted DICOM file is opened.

HealthcareCritical Infrastructure

5d ago· 3 min read

NEWSHIGHCVE-2025-14847

ABB Ability Zenon

Successful exploitation of these vulnerabilities could allow attackers to bypass security, crash systems, execute unauthorized actions, or compromise data. The following versions of ABB Ability Zenon are affected: IIo...

WHY IT MATTERS

Successful exploitation of these vulnerabilities could allow attackers to bypass security, crash systems, execute unauthorized actions, or compromise data.

WindowsDenial of ServiceHealthcare

5d ago· 22 min read

NEWSHIGHCVE-2026-17583

Thermo Fisher Applied Biosystems Genetic Analyzers

Successful exploitation of this vulnerability could allow an attacker to modify .fsa/.hid output files, tampering with DNA data and resulting in inaccurate test results. The following versions of Thermo Fisher Applied...

WHY IT MATTERS

Successful exploitation of this vulnerability could allow an attacker to modify .

HealthcareCritical Infrastructure

7d ago· 4 min read

Timeline

Why It Was So Devastating

Lessons for IT/Security Teams

Related

Medixant RadiAnt DICOM

ABB Ability Zenon

Thermo Fisher Applied Biosystems Genetic Analyzers