Change Healthcare
UnitedHealth Group health-payments business hit by ALPHV ransomware in 2024.
Change Healthcare told US health regulators on 31 July 2025 that 192.7 million people were affected by its February 2024 ransomware attack, after which the ALPHV gang vanished with the ransom.
Last refreshed: 12 October 2026
How did one login without MFA stall US healthcare payments?
Timeline for Change Healthcare
Named as Change Healthcare
Cybersecurity: Threats and Defences: Mentioned in: Ransomware crews' claims fall to 815Background
Change Healthcare is a US health payments and data business owned by UnitedHealth Group. In April 2024 UnitedHealth said the unit processes about 6% of US healthcare payments.
The 2024 attack began in February, when criminals used stolen credentials to log in to a Citrix remote-access portal that had no multi-factor authentication. Andrew Witty, then UnitedHealth's chief executive, told the US Senate Finance Committee on 1 May 2024 that the intruders took data and set off ransomware nine days after getting in, and that the decision to pay a ransom was his. In a filing of 31 July 2025, Change Healthcare put the number of people affected at 192.7 million.
ALPHV, the gang behind the attack, disappeared in March 2024 after collecting the payment, apparently cheating the affiliate WHO carried it out. Its affiliates moved to RansomHub.