Change Healthcare Re-Extortion (Apr 2024): Ransom Did Not End the Incident

Incident summary

Change Healthcare, a UnitedHealth Group subsidiary that processes approximately one third of US healthcare claims, was hit by ALPHV/BlackCat ransomware on February 21, 2024. The initial attack timeline and technical details are documented in the separate change-healthcare-ransomware-2024 Decipher File. The April 2024 re-extortion is operationally distinct and warrants its own analysis. In late February 2024, UnitedHealth Group paid approximately $22 million to the ALPHV ransomware operator in exchange for a promise to delete the exfiltrated patient data. The payment was confirmed publicly by UHG CEO Andrew Witty in congressional testimony on May 1, 2024.

The ALPHV operator absconded with the full ransom rather than paying the affiliate who carried out the actual intrusion, an exit-scam pattern that emerged in late February 2024 in dark web forum posts. The ALPHV operator simultaneously announced infrastructure takedown by international law enforcement, though subsequent industry analysis indicated the operator-side takedown announcement was likely a cover story for the exit scam. The affiliate, who retained possession of the exfiltrated Change Healthcare data, was operationally incentivized to monetize the data through a different channel since the affiliate had not been paid through the ALPHV operator's normal revenue split.

In April 2024, the affiliate posted the Change Healthcare data for sale through the RansomHub ransomware-as-a-service operator, the same group later attributed to the August 2024 Halliburton intrusion. RansomHub's leak site featured Change Healthcare data samples and demanded a second ransom payment. UnitedHealth Group did not publicly confirm whether a second ransom was paid. The structural fact, confirmed in Witty's congressional testimony, was that the first $22 million payment did not produce the negotiated outcome of data deletion. The patient data remained in criminal hands and was actively monetized through the RansomHub channel.

Attack technique

The re-extortion technique pattern is operationally distinct from the initial ransomware intrusion. The initial intrusion used Citrix portal exploitation without multifactor authentication for initial access (T1078, T1133), per UHG CEO Witty's May 1, 2024 congressional testimony. Post-compromise, the ALPHV affiliate performed standard ransomware-affiliate activity including reconnaissance, lateral movement, credential harvesting, data exfiltration to attacker-controlled cloud storage (T1567.002), and final ransomware deployment (T1486). That is the standard double-extortion ransomware-as-a-service operational pattern.

What is distinct in the Change Healthcare case is the post-payment timeline. The ransom payment in late February 2024 was made to the ALPHV operator, who is the ransomware-as-a-service brand. The operator runs the infrastructure, the leak site, the negotiations, and the cryptocurrency payment intake. The affiliate is the actor who actually breaks into the victim and performs the encryption and exfiltration work. The standard revenue split is roughly 70 percent to the affiliate and 30 percent to the operator. The ALPHV operator in this case kept the full ransom rather than paying the affiliate their share, an exit-scam pattern that has emerged sporadically across the ransomware-as-a-service criminal market.

The affiliate retained physical possession of the exfiltrated Change Healthcare data. Possession of the data is independent of any agreement between victim and operator. The operator's promise to delete the data, even if good-faith, only affects the operator's copy of the data. The affiliate's separate copy is not affected by an operator-side deletion. This is a structural property of the ransomware-as-a-service architecture that victims and incident response negotiators do not always fully internalize. The Change Healthcare case made the structural property publicly visible.

The affiliate's re-monetization through RansomHub illustrated the broader operator-affiliate market dynamic. Affiliates are mobile across operators. The same actor can carry out intrusions on behalf of LockBit, ALPHV, RansomHub, Akira, BlackBasta, and other operators depending on which offers the best terms at the time. When one operator exits or is disrupted, the affiliates redistribute to other operators. The affiliate behind the Change Healthcare intrusion moved to RansomHub in early 2024 along with other ALPHV-affiliated actors. RansomHub's emergence as a top-tier ransomware-as-a-service operator in 2024 was driven in part by this post-ALPHV affiliate migration.

Impact and consequences

Patient-data scope expanded substantially through 2024 and into 2025. UnitedHealth Group's June 2024 OCR breach notification initially estimated approximately 100 million affected individuals. The July 2024 update revised the estimate. The October 2024 update further revised the figure. UHG's January 2025 OCR update set the affected individual count at approximately 190 million, making the Change Healthcare incident the largest healthcare data breach in US history. The expansion reflected the ongoing forensic work to identify which specific patient records had been in the affected data extracts, not a separate additional intrusion event.

The dual-extortion timeline produced a separate set of consequences beyond the patient-data scope. The fact that UHG paid $22 million and still had the data leaked through RansomHub became a reference case in the industry-wide ransom-payment policy debate. Public-policy debate through 2024 over whether ransom payment should be restricted by federal regulation cited the Change Healthcare case directly. The argument that paying ransoms does not reliably produce the negotiated outcome was operationally demonstrated, beyond theoretical concerns. The argument that not paying produces worse outcomes for victims is also valid, but the Change Healthcare case complicated the cost-benefit case for payment.

Provider-side financial impact extended through 2024 and into 2025. Change Healthcare's pharmacy and claims processing systems were unavailable to providers for weeks, with partial restoration through March and April 2024 and ongoing service degradation through mid-2024. UHG provided approximately $9 billion in advance payments and loans to affected providers per Witty's congressional testimony, with repayment terms structured over an extended period. Provider-side cash flow impact during the downtime was severe for smaller pharmacy and physician practice operations that depend on Change Healthcare claims processing for revenue cycle operations.

Regulatory consequence was extensive. HHS Office for Civil Rights opened a HIPAA enforcement investigation. State attorneys general opened parallel investigations. Class action litigation was filed in the weeks following the breach disclosure and consolidated into multidistrict litigation. UHG's UnitedHealthcare insurance operations faced separate state insurance regulator scrutiny. Congressional oversight extended beyond the May 2024 testimony into ongoing committee work through 2024 and 2025. The Change Healthcare incident became the reference case in the FY2025 Office of the National Cyber Director priorities on healthcare-sector cybersecurity baseline-raising.

Indicators of Compromise

Specific artifacts defenders should hunt for. Cross-reference these against your existing detection rules before acting on them.

Lessons for defenders

Ransom payment does not guarantee data deletion, and the structural reason is the ransomware-as-a-service affiliate architecture. The operator can promise to delete the operator's copy of the data, but the affiliate's separate copy is not affected by an operator-side deletion. Build this fact into the ransom payment decision framework: payment can produce decryption keys reliably (when the operator delivers on the technical promise), and payment can produce operator-side deletion verification (when the operator delivers on the operational promise), but payment cannot reliably produce affiliate-side data deletion. Plan customer notification, regulatory disclosure, and downstream identity-monitoring as if the data will remain in criminal hands regardless of payment decision.

Affiliate-operator separation matters in negotiation strategy. Ransom negotiations with ransomware-as-a-service operators are with the operator brand, not with the affiliate who carried out the intrusion. The affiliate may have separate operational incentives, separate possession of the exfiltrated data, and separate willingness to honor or violate the operator's negotiated commitments. Incident response negotiators should understand the affiliate-operator dynamics of the specific RaaS brand involved, and the public exit-scam history of operators including ALPHV, Conti, LockBit, and others. Mandiant, Recorded Future, and CrowdStrike publish detailed brand-by-brand operator and affiliate analysis.

Patient-data scope expansion through forensic review is the normal pattern, not the exception. Change Healthcare's affected individual count expanded from approximately 100 million in June 2024 to approximately 190 million in January 2025. The expansion is forensic, not from additional intrusion events. Plan customer notification timing and regulatory disclosure cadence with the expectation that the affected individual count will expand as forensic review progresses. Multiple notification waves and clear customer-side communication about why the count is expanding reduces customer trust friction relative to single delayed notification.

Multifactor authentication on every public-facing identity surface is a structural control with measurable impact. The initial access vector at Change Healthcare was a Citrix portal without multifactor authentication. The same structural vulnerability has been present in multiple major 2024 incidents including the Snowflake customer breaches and the AT&T metadata exposure. Audit every public-facing identity surface in your environment for MFA enforcement: VPN portals, Citrix and other remote desktop gateways, OWA and other email web access, SaaS administrator consoles, and equivalent surfaces. MFA enforcement at the identity-provider level rather than at individual surfaces is the structural control.

Related career roles

The cybersecurity professionals whose day-to-day work would have detected, investigated, or contained this incident.

• /careers/incident-responder
• /careers/healthcare-security-analyst
• /careers/threat-intelligence-analyst
• /careers/ciso

Related Decipher Files

• Change Healthcare Ransomware (Feb 2024): ALPHV via Unprotected Citrix
• Ascension Health Ransomware (May 2024): Black Basta Took Down 140 Hospitals
• Snowflake Breaches 2024: Ticketmaster, AT&T, Santander Hit via Customer-Side Credentials

Frequently asked questions