Back to the archive
Incident file · 2024
Change Healthcare
Healthcare payments · United States · Threat actor: ALPHV / BlackCat
Ransomware
Ransom paid
- US$22.0m
- Ransom demanded
- US$22.0m
- Ransom paid
- 30 days
- Estimated downtime
- US$872m
- Est. revenue lost
What happened
A Citrix portal without MFA allowed ransomware deployment that froze US claims and pharmacy payment processing for weeks.
How it ended
Paid US$22m; a second extortion demand followed after the affiliate withheld data, making it one of the costliest breaches on record.
Data affected
~100 million individuals
Would your business survive this incident?
We stress-test detection, response and recovery so a ransom demand is never your only option.