In February 2024 the ALPHV/BlackCat ransomware group broke into Change Healthcare, which processes a large share of US medical claims. The way in: stolen credentials on a Citrix remote-access portal that had no multi-factor authentication. A US$22 million ransom was paid.
Pharmacies could not fill prescriptions and clinics could not get paid. The parent company put the cost at about US$2.45 billion, and the final count — about 190 million people affected — was only confirmed in 2025.
Three lessons: one supplier sat under thousands of organizations, so one failure became a sector-wide outage; MFA on every remote path is the cheapest control with the biggest payoff; and the organizations hurt most were not breached themselves — their supplier was.
What it means for your business
- Enforce MFA on every remote and admin login — no exceptions.
- Map critical suppliers and single points of failure; plan manual fallbacks.
- Rehearse ransomware response end to end, including the payment decision.
How MTH can help: Our Security Operations service delivers MFA everywhere, supplier risk reviews and tested ransomware recovery plans.
This briefing is original commentary by MTH based on public reporting; figures are as reported by the sources named above and may be revised over time.
