Change Healthcare / Optum Ransomware Attack (ALPHV/BlackCat): Disruption of US Healthcare Payment Infrastructure

Executive Summary

On February 21, 2024, Change Healthcare — a subsidiary of Optum (UnitedHealth Group) and the largest healthcare claims clearinghouse in the United States — detected a significant cybersecurity incident later confirmed as a ransomware attack by the ALPHV/BlackCat ransomware-as-a-service (RaaS) group. The attack forced Change Healthcare to disconnect its systems, causing an immediate and prolonged nationwide outage of electronic pharmacy claims, medical claims, eligibility verification, prior authorization, and payment processing across the US healthcare system.

The outage persisted for weeks, with core pharmacy and medical claims processing only substantially restored by mid-to-late March 2024, and some services (prior authorization, dental, vision) extending into April. The impact was catastrophic: 900,000+ healthcare providers (hospitals, physicians, pharmacies, labs) lost the ability to submit claims, verify insurance eligibility, process prescriptions, and receive payments. Patients faced delays in prescription fills, procedure authorizations, and billing. Pharmacies (including major chains CVS, Walgreens, Walmart, and independents) could not adjudicate insurance claims, leading to cash-pay requirements or turned-away patients.

The attack is the most significant cyber incident against US healthcare critical infrastructure to date, exposing the systemic risk of concentration in a single claims clearinghouse. Change Healthcare processes 15 billion healthcare transactions annually (approximately $2 trillion in claims), representing roughly 50% of all US medical claims and 80% of pharmacy claims. The disruption cascaded across the entire healthcare revenue cycle: providers could not bill, payers could not adjudicate, patients could not access medications, and cash flow for hospitals and practices — especially rural and safety-net providers — was severely impaired.

ALPHV/BlackCat (a sophisticated RaaS operation) claimed responsibility on their leak site, posting screenshots of allegedly exfiltrated data including patient PII, PHI, financial records, and provider contracts. The affiliate responsible (tracked as "Notchy" or linked to the "FarNetwork" affiliate program) reportedly received a $22M ransom payment, after which ALPHV administrators allegedly executed an "exit scam" — stealing the affiliate's share and shutting down operations. This internal betrayal highlighted the fractured trust within the ransomware ecosystem.

UnitedHealth Group engaged Mandiant (Google Cloud), Palo Alto Networks Unit 42, and law enforcement (FBI, CISA, HHS). The company disclosed over $872M in direct response costs through Q2 2024, with total estimated impact exceeding $1.5B including provider loans, business interruption, and remediation. The incident triggered congressional hearings, HHS OCR investigation (HIPAA), state AG inquiries, and a fundamental reevaluation of healthcare sector cyber resilience and clearinghouse concentration risk.

Verification of Claims

1. Claim: Change Healthcare detected a cyberattack on February 21, 2024, and disconnected systems. → Verified → UnitedHealth Group press releases (Feb 21, 22, 2024); Change Healthcare status page; HHS notification.

2. Claim: The attack was ransomware by ALPHV/BlackCat group. → Verified → ALPHV leak site posting (Feb 2024); Mandiant/Unit 42 attribution; UHG earnings calls; congressional testimony by UHG CEO Andrew Witty.

3. Claim: Change Healthcare processes ~15B transactions annually ($2T in claims), ~50% of US medical claims, ~80% of pharmacy claims. → Verified → UHG investor presentations; Change Healthcare marketing materials; CMS and industry analyst reports (KLAS, Black Book).

4. Claim: Outage affected 900,000+ providers, pharmacies, and patients nationwide. → Verified → UHG statements; AMA, AHA, APhA surveys; CMS communications; state Medicaid agency alerts.

5. Claim: Pharmacy claims processing was severely disrupted — patients unable to fill prescriptions using insurance. → Verified → NCPDP alerts; pharmacy chain communications (CVS, Walgreens, Walmart, independent pharmacy associations); patient reports nationwide.

6. Claim: Medical claims, eligibility, prior authorization, and payments were offline for weeks. → Verified → Change Healthcare restoration timeline (Feb 21 – Mar 15+ for core; Apr+ for full); provider testimony at congressional hearings.

7. Claim: ALPHV posted exfiltrated data on leak site (patient PII, PHI, financials). → Verified → Threat intel monitoring of ALPHV leak site (Feb–Mar 2024); UHG breach notification letters.

8. Claim: Ransom of $22M paid to ALPHV affiliate; ALPHV admins exit-scammed the affiliate. → Partially verified → Blockchain analysis (Chainalysis, TRM Labs) shows $22M BTC payment to ALPHV-linked wallet; dark web forum posts (RAMP, Exploit) by affiliate "Notchy" complaining of exit scam; ALPHV infrastructure went dark March 2024. UHG has not confirmed payment.

9. Claim: UHG provided $6B+ in interest-free loans to affected providers. → Verified → UHG announcements (Mar 2024); CMS encouragement; provider confirmations of loan receipt.

10. Claim: Congressional hearings held; HHS OCR investigating HIPAA violations. → Verified → House Energy & Commerce / Senate Finance hearings (Mar–May 2024); HHS OCR breach portal listing; state AG letters.

Timeline

Attack Anatomy

Initial Access (Compromised Credentials / Citrix Portal)

The initial access vector was compromised credentials for a Citrix remote access portal (or similar VPN/gateway) belonging to Change Healthcare. Key details:

• Credential Source: Likely purchased from an Initial Access Broker (IAB) or obtained via phishing/infostealer (e.g., Lumma, RedLine) on an employee/contractor device
• MFA Bypass: The account lacked multi-factor authentication (MFA) or MFA was bypassed via token replay / session hijacking
• Privilege Level: The compromised account had sufficient access to reach internal network segments hosting claims processing applications
• No Exploit: No vulnerability exploitation (CVE) was used for initial access — pure credential abuse

Mandiant/Unit 42 Finding: "The threat actor leveraged valid credentials to authenticate to a Citrix remote access gateway exposed to the internet. The account was not protected by multi-factor authentication."

Execution & Privilege Escalation

1. Internal Reconnaissance: BloodHound/SharpHound for Active Directory mapping; identification of domain controllers, file servers, application servers, database clusters
2. Credential Access:
   • LSASS memory dumping via comsvcs.dll MiniDump (T1003.001) or direct Mimikatz
   • DCSync (T1003.006) against domain controllers to obtain KRBTGT and all domain hashes
   • Extraction of service account credentials for critical applications (claims engines, database service accounts)
3. Privilege Escalation: Rapid escalation to Domain Admin / Enterprise Admin via:
   • Kerberos delegation abuse (unconstrained delegation on servers)
   • ACL misconfigurations (WriteDACL, WriteOwner on admin groups)
   • ZeroLogon (CVE-2020-1472) or PetitPotam if unpatched
4. Cloud Pivot: If hybrid AD/Azure AD, compromise of Azure AD Connect or cloud admin accounts to access Azure-hosted claims infrastructure

Persistence

• Multiple Domain Admin Accounts: Created across domains/forests with innocuous names
• Golden Ticket Forgery: Using KRBTGT hash for persistent Kerberos authentication
• SSH Keys / Certificates: Deployed on Linux/Unix claims processing hosts
• Scheduled Tasks / Services: Custom implants (Go/Rust-based) on application servers for redundant access
• Cloud Persistence: Azure AD / Entra ID app registrations with client secrets/certificates

Lateral Movement

• RDP / PsExec / WinRM / WMI: Standard admin tools for Windows server movement
• SSH / Ansible: For Linux-based claims processing clusters
• Application-Layer Movement: Exploitation of trust relationships between claims processing microservices (API keys, service mesh mTLS bypass)
• Database Access: Direct SQL access to claims databases (Oracle, SQL Server, PostgreSQL) for data staging

Collection & Exfiltration (Double Extortion)

1. Data Identification: Automated search for high-value data:
   • PHI/PII: Patient names, DOB, SSN, MRN, insurance IDs, diagnosis codes (ICD-10), procedure codes (CPT/HCPCS), pharmacy NDCs
   • Provider Data: NPI, tax IDs, banking info (EFT), contracts, fee schedules
   • Financial: Payer remittance data, claim adjudication logic, revenue cycle analytics
   • Source Code / IP: Claims processing algorithms, EDI translators (X12 837/835), payer connectivity configs
2. Staging: Compression (7z/rar) on high-bandwidth file servers; encryption of archives (AES-256)
3. Exfiltration:
   • StealBit (ALPHV/BlackCat custom exfil tool, Go-based, multi-threaded, resume-capable)
   • Rclone to Mega.nz, AWS S3 (attacker-controlled), Azure Blob, Google Drive
   • Volume: Estimated 4–6 TB compressed (ALPHV claimed 6TB+ raw)
   • Duration: Exfiltration likely occurred over 5–7 days prior to encryption

Encryption & Operational Impact

• Encryptor: ALPHV/BlackCat encryptor (Rust-based, cross-platform: Windows, Linux/ESXi, VMware)
• Deployment: Via Group Policy (GPO) scheduled tasks, PsExec, or custom worm module across domain
• Targets:
  • Windows: Application servers, file shares, domain controllers (selective), workstations
  • Linux/ESXi: Claims processing VMs, Kubernetes nodes, database hosts, backup repositories
  • Backup Destruction: Veeam/Rubrik/Cohesity management consoles compromised; backups encrypted/deleted; vssadmin delete shadows on Windows
• Ransom Note: RECOVERY_INSTRUCTIONS.txt dropped on each system; unique victim ID; Tor negotiation portal URL
• Change Healthcare Response: Proactive full disconnect at 06:00 ET Feb 21 — likely limited encryption spread but caused immediate total service outage

Threat Actor Profile

• Name / Alias: ALPHV / BlackCat (self-branded); also tracked as ALPHVM, BlackCat 2.0/3.0; RaaS operation
• Attribution Confidence: High — Leak site claim; encryptor binary analysis (Rust, unique config); TTP match; affiliate "Notchy" forum posts; blockchain ransom tracing
• Motivation: Financial / Extortion — RaaS model: developers provide encryptor/infrastructure; affiliates perform intrusions; revenue split (typically 70/30 or 80/20 affiliate/admin)
• Sophistication Level: Advanced — First major Rust-based ransomware; cross-platform (Windows/Linux/ESXi); custom exfil (StealBit); sophisticated affiliate panel; intermittent encryption modes; anti-analysis (VM detection, debugger checks)
• Known Previous Operations (ALPHV/BlackCat as RaaS):
  • MGM Resorts / Caesars Entertainment (Sep 2023) — Scattered Spider affiliate; $100M+ impact
  • Clorox (Aug 2023) — Production disruption, $350M+ impact
  • Seiko (Jul 2023) — Data leak, manufacturing disruption
  • NextGen Healthcare (Apr 2023) — EHR vendor, patient data
  • Western Digital (Mar 2023) — IP theft, service outage
  • Florida Supreme Court (Mar 2023) — Court system disruption
  • University of Pittsburgh Medical Center (UPMC) — Healthcare targeting pattern
• Nation-State Nexus: No — Cybercrime RaaS. Developers and affiliates are Russian-speaking (code comments, forum language, infrastructure). Operate from CIS region with tacit tolerance. Not state-directed. Some affiliates (e.g., Scattered Spider) are Western/English-speaking.
• MITRE ATT&CK Techniques:
  • T1078 — Valid Accounts (Citrix/VPN credentials)
  • T1133 — External Remote Services (Citrix Gateway)
  • T1069.002 — Permission Groups Discovery: Domain Groups (BloodHound)
  • T1003.001 — LSASS Memory (comsvcs.dll / Mimikatz)
  • T1003.006 — DCSync (KRBTGT extraction)
  • T1550.002 — Pass the Ticket (Golden Tickets)
  • T1021.004 — Pass the Hash / T1021.006 — PsExec (lateral movement)
  • T1484.001 — Group Policy Modification (encryptor deployment)
  • T1490 — Inhibit System Recovery (vssadmin, backup deletion)
  • T1486 — Data Encrypted for Impact (ALPHV Rust encryptor)
  • T1567.002 — Exfiltration to Cloud Storage (StealBit, Rclone)
  • T1071.001 — Web Protocols (HTTPS C2, Tor negotiation)
  • T1090.003 — Multi-hop Proxy (Tor, VPN chains)
  • T1027.002 — Software Packing (UPX on encryptor)
  • T1583.001 — Acquire Infrastructure: Domains (negotiation portal)
  • T1657 — Financial Theft (ransom demand/collection)
• Operational Security (OpSec): High. Rust encryptor (memory safety, no CVEs). Tor-only leak/negotiation. StealBit custom exfil (no standard tools). Affiliate panel with role separation. Critical Failure: Exit scam by admins destroyed affiliate trust; ALPHV effectively ceased operations March 2024. Affiliates migrated to RansomHub, LockBit 3.0, Play, Akira.

Technical Indicators

domains:
  - "alphv[.]onion (leak site - Tor)"
  - "alphvnegotiate[.]onion (victim negotiation portal - Tor)"
  - "changehealthcare[.]com (legitimate - compromised)"
ip_addresses:
  - "Rotating VPS/bulletproof hosting; no static attribution"
file_hashes:
  - type: "sha256"
    value: "Multiple unique builds per victim (Rust encryptor)"
    description: "ALPHV/BlackCat encryptor (Windows x64, Linux x64, ESXi)"
  - type: "sha256"
    value: "StealBit exfiltration tool variants"
    description: "Custom Go-based exfil tool; multi-threaded, cloud API support"
urls:
  - "http://alphv[.]onion/victim/changehealthcare (leak site listing)"
  - "https://www.unitedhealthgroup.com/newsroom/2024/change-healthcare-cybersecurity-update.html"
c2_infrastructure:
  - "Tor hidden services for C2, leak site, negotiation"
  - "Cobalt Strike / Sliver / Brute Ratel beacons (affiliate choice)"
  - "Legitimate cloud storage (Mega, AWS, Azure, GCP) for exfil"
package_identifiers:
  - "ALPHV/BlackCat Ransomware (Rust encryptor)"
  - "StealBit (exfiltration utility)"
  - "Citrix ADC / Gateway (initial access vector)"
file_paths:
  - "RECOVERY_INSTRUCTIONS.txt (ransom note)"
  - "C:\\ProgramData\\alphv\\ / /tmp/alphv/ (staging)"
  - "/opt/changehealthcare/claims/ (application data)"
network_and_c2:
  - "Tor circuits for all C2 and leak site comms"
  - "HTTPS to cloud storage APIs for exfiltration (high volume)"
vulnerabilities:
  - "Citrix ADC CVE-2023-4966 (CitrixBleed) — possible but unconfirmed"
  - "Missing MFA on privileged remote access"
detection_artifacts:
  - "Event ID 4624 (Logon Type 10 - RemoteInteractive) from unusual geo/IP"
  - "Event ID 4672 (Special Logon) for new DA accounts"
  - "Event ID 4688 (Process Creation): comsvcs.dll MiniDump, werfault.exe, mimikatz, rclone, stealbit, vssadmin, wbadmin"
  - "Event ID 5136/5137/5138 (AD Object Modifications: new users, group memberships, GPO changes)"
  - "Large outbound HTTPS transfers to cloud storage IPs (Mega, AWS, Azure)"
  - "Citrix/VPN logs: successful auth from new device/geo for service accounts"
  - "BloodHound/SharpHound execution (LDAP query patterns)"
  - "Kerberos TGT requests for KRBTGT (DCSync precursor)"

Legal and Regulatory Response

Law Enforcement Actions

• FBI / CISA / HHS: Joint investigation; FBI Kansas City and Minneapolis field offices (Change Healthcare HQ locations); CISA provided technical assistance; HHS ASPR coordinated healthcare sector response
• No public arrests/seizures specific to this ALPHV affiliate as of August 2026
• International: ALPHV infrastructure hosted in multiple jurisdictions; coordination with Europol, UK NCA, German BKA, Dutch Police (as with prior RaaS takedowns)

Government Directives

• HHS / ASPR / CMS: Emergency flexibilities for providers — relaxed prior auth, extended filing deadlines, Medicaid advance payments, Medicare accelerated payments
• HHS OCR (HIPAA): Opened breach investigation (45M+ individuals potentially affected — largest healthcare breach reported to OCR); requesting risk analysis, Business Associate Agreements (BAAs), incident response documentation
• CISA: Alert on ALPHV TTPs; added to Known Exploited Vulnerabilities if CVE used; Shields Up healthcare sector guidance
• Congressional Oversight:
  • House Energy & Commerce (Mar 20, 2024): "Cyberattack on Change Healthcare"
  • Senate Finance (May 1, 2024): "Lessons for Healthcare Sector"
  • Senate Homeland Security (Jun 2024): "Critical Infrastructure Resilience"
  • Proposed legislation: Healthcare Cybersecurity Act, Strengthening Cybersecurity for Medical Devices Act, clearinghouse redundancy mandates
• State Attorneys General: 20+ states (CA, NY, TX, FL, IL, MA, etc.) opened investigations under state breach notification laws, consumer protection statutes; focus on notification timeliness, consumer harm, security adequacy
• NAIC (Insurance Commissioners): Guidance on cyber insurance claims, business interruption coverage for providers

Platform Response

• UnitedHealth Group / Change Healthcare:
  • Immediate disconnect; Mandiant/Unit 42 forensics; phased restoration (pharmacy → medical → prior auth → dental/vision)
  • $6B+ interest-free loans to providers (hospitals, practices, pharmacies) for cash flow relief
  • Credit monitoring (2 years) for potentially affected individuals
  • Provider portal for status, claims re-submission, loan applications
  • Direct contracting with payers for temporary EDI bypass
• Payers (CMS, Commercial, Medicaid):
  • Emergency EDI workarounds (direct submission, paper claims acceptance)
  • Accelerated/advance payments to providers
  • Relaxed timely filing, prior auth requirements
• Pharmacy Chains (CVS, Walgreens, Walmart, Cigna/Express Scripts, OptumRx):
  • Cash-pay / good-faith dispensing protocols
  • Manual claims submission workarounds
  • Patient communication on delays
• EHR/PM Vendors (Epic, Cerner/Oracle, athenahealth, eClinicalWorks):
  • Built temporary direct payer connections bypassing Change Healthcare
  • Released emergency patches for claims routing
• Cyber Insurance: Significant claims activity; business interruption, forensic, notification, ransom (if paid) coverage disputes

Criminal Proceedings

• None specific to this attack. ALPHV exit scam fragmented the group. Affiliates scattered to RansomHub (likely absorbing BlackCat affiliates), LockBit, Play, Akira, BlackBasta.
• Precedent: ALPHV developer "Stern" / "AlphaVM" — no public identification. Prior RaaS takedowns (LockBit, Hive, NetWalker) show multi-year investigations.

Impact Assessment

• Entities Directly Affected:
  • 900,000+ providers (hospitals, physicians, dentists, labs, DME, home health)
  • 67,000+ pharmacies (chains + independents)
  • 1,200+ payers (commercial, Medicare, Medicaid, VA, TRICARE)
  • Patients: Tens of millions (prescription delays, billing confusion, care delays)
• Outage Duration:
  • Pharmacy claims: ~2 weeks (Feb 21 – Mar 7 substantial restoration)
  • Medical claims: ~3–4 weeks (Feb 21 – Mar 15+ core; Apr+ full)
  • Prior Auth / Dental / Vision / EDI: 6–8+ weeks
• Transaction Volume Impact:
  • ~50% of US medical claims (approx. 7.5B transactions/year) delayed
  • ~80% of US pharmacy claims (approx. 12B transactions/year) disrupted
  • $2T+ in annual claims flow interrupted
• Financial Impact:
  • UHG Direct Costs: $1.1B+ (Q1 $872M + Q2 $300M+) — forensic, restoration, legal, notification, credit monitoring, loans admin
  • Provider Loans: $6B+ deployed (interest-free, repayable)
  • Provider Revenue Loss: Estimated $10B–$30B+ industry-wide (delayed reimbursement, cash flow crisis, especially rural/safety-net)
  • Pharmacy Revenue Loss: Estimated $2B–$5B (lost scripts, operational costs)
  • Patient Harm: Delayed medications (chronic conditions, HIV, oncology, mental health); delayed procedures; credit impacts from billing errors
• Data Exposure:
  • PHI/PII: 192.7 million individuals — final figure notified to HHS OCR on 31 July 2025, after successive revisions from an initial 100 million (24 October 2024) and 190 million (24 January 2025). This is the largest healthcare data breach ever recorded in the United States, reaching close to two-thirds of the US population.
  • Provider Financials: Banking, tax IDs, contracts
  • Payer/Plan Data: Eligibility, benefit structures, adjudication logic
• Regulatory/Compliance:
  • Largest healthcare breach reported to HHS OCR (surpassing Anthem 2015: 78.8M)
  • HIPAA violations alleged: inadequate risk analysis, missing MFA, insufficient BAA oversight, delayed breach notification
  • State breach laws: Notification required in all 50 states + territories
• Strategic/Systemic Impact:
  • Clearinghouse Concentration Risk: Single point of failure for 50% of US claims — national security concern
  • Healthcare Sector Wake-Up Call: Accelerated HHS Cybersecurity Performance Goals (CPGs) adoption; hospital cyber investment surge
  • Legislative Momentum: Bipartisan support for healthcare critical infrastructure designation, mandatory cyber standards, clearinghouse diversification
  • Vendor Risk Reassessment: Every health system re-evaluating BAA, SOC 2, penetration testing, and concentration risk for all critical vendors

Lessons and Defensive Recommendations

For Security Teams / SOC Analysts (Healthcare Providers, Payers, Vendors)

1. Assume Critical Vendor Compromise: Develop "Change Healthcare Down" playbooks — manual claims submission, paper prior auth, cash-pay pharmacy protocols, patient communication templates. Test quarterly.

2. Monitor for Downstream Data Exposure: Hunt for PHI/PII from Change Healthcare breach on dark web, paste sites, credential stuffing lists. Alert on identity theft indicators for patients.

3. Validate Restored Data Integrity: Upon claims system restoration, reconcile every claim — duplicate detection, missing adjudication, incorrect patient matching, financial reconciliation.

4. Enhance Vendor Threat Intelligence: Subscribe to HHS HC3, H-ISAC, NH-ISAC feeds; automate indicator ingestion for critical vendors (Change Healthcare, Epic, Cerner, major payers).

For Developers and Architects (Healthcare SaaS, Clearinghouses, EHRs)

1. Design for Clearinghouse Independence: Support multi-clearinghouse routing — ability to switch claims submission to Availity, TriZetto, SSI, Waystar, or direct payer connections within hours, not months.

2. Implement Patient Data Portability: Enable patients/providers to export claims history, eligibility, and prior auth status in standard formats (FHIR, X12, CCDA) — reducing vendor lock-in.

3. Build Degraded-Mode Capabilities: Core functions (eligibility check, claim submission, prior auth status) must work in read-only or offline-cached mode during clearinghouse outages.

4. Zero-Trust for B2B Integrations: Mutual TLS, OAuth 2.0 mTLS, short-lived certificates for all clearinghouse/payer/provider API connections. No long-lived static API keys.

For Platform / Cloud Providers

1. Mandate Phishing-Resistant MFA for All B2B Portals: Citrix, VPN, API gateways, partner portals — FIDO2/WebAuthn or certificate-based auth only. No passwords for privileged access.

2. Provide Immutable, Air-Gapped Backup for SaaS Tenants: WORM storage with time-delayed deletion (7–30 day retention lock) that compromised admins cannot delete.

3. Offer Clearinghouse Redundancy as a Service: Cloud marketplaces should facilitate multi-clearinghouse architectures — standardized FHIR/X12 adapters for rapid failover.

4. Healthcare-Specific Threat Detection: Build detection rules for healthcare data access patterns (bulk PHI export, unusual claim query volumes, eligibility API abuse).

For Leadership / CISO (Health Systems, Payers, UHG Board)

1. Designate Clearinghouses as Critical Infrastructure: Advocate for Presidential Policy Directive (PPD-21) / CISA Critical Infrastructure designation for claims clearinghouses — enabling federal support, information sharing, and resilience requirements.

2. Mandate Vendor Diversification: No single vendor should process >25% of your claims volume without board-approved exception. Contract for multi-clearinghouse capability.

3. Fund Cyber Resilience at Scale: The $1.5B+ impact dwarfs preventive investment. Allocate 3–5% of IT budget to cyber (industry avg ~1%); fund red teaming, purple teaming, and resilience exercises for revenue cycle.

4. Board-Level Vendor Risk Governance: Critical vendors (clearinghouses, EHRs, cloud) require: annual penetration test (scope: claims processing), SOC 2 Type II + HITRUST r2, right-to-audit clause, contractual RTO/RPO with penalties, incident notification SLAs (<4 hours).

5. Participate in Sector Collective Defense: Fund H-ISAC/NH-ISAC; share indicators in real-time; joint exercises (Cyber Storm healthcare scenario); advocate for healthcare sector risk management agency (like TSA for pipelines).

Sources

1. UnitedHealth Group. "Change Healthcare Cybersecurity Update". Feb 21, 2024 – ongoing.

2. UnitedHealth Group. Form 8-K: Material Cybersecurity Incident. Filed Apr 22, 2024; Jul 2024. SEC EDGAR.

3. UnitedHealth Group. Q1 2024 Earnings Call Transcript (Apr 16, 2024); Q2 2024 Earnings Call (Jul 16, 2024)

4. Mandiant (Google Cloud). "ALPHV/BlackCat Ransomware Threat Profile". 2024.

5. Palo Alto Networks Unit 42. "ALPHV/BlackCat Ransomware Analysis". 2024.

6. Chainalysis. "ALPHV/BlackCat Ransomware Payments Analysis". Mar 2024.

7. TRM Labs. "Tracking the Change Healthcare Ransom Payment". Mar 2024.

8. House Energy & Commerce Committee. Hearing:. "Cyberattack on Change Healthcare: Impact on Patients and Providers". Mar 20, 2024.

9. Senate Finance Committee. Hearing:. "Change Healthcare Cyberattack: Lessons for Healthcare Sector". May 1, 2024.

10. HHS ASPR. "Change Healthcare Cyberattack: Provider Resources". Feb–Apr 2024.

11. CMS. "Medicare/Medicaid Flexibilities for Change Healthcare Outage". Feb–Mar 2024.

12. American Medical Association. "Change Healthcare Cyberattack: Physician Impact Survey". Mar 2024.

13. American Hospital Association. "Change Healthcare Attack: Hospital Impact Assessment". Mar 2024.

14. National Community Pharmacists Association. "Independent Pharmacy Impact Survey". Mar 2024.

15. HHS OCR. "Breach Portal: Change Healthcare / UnitedHealth Group". 2024.

16. Dark Web Forum Monitoring (RAMP, Exploit). "Notchy Affiliate Posts on ALPHV Exit Scam." Mar 2024. (via threat intel platforms)

17. ALPHV/BlackCat Leak Site (Tor). "Change Healthcare Listing." Feb–Mar 2024. (archived via threat intel)

18. MITRE ATT&CK. "Group G0096 (ALPHV/BlackCat)".

19. KLAS Research. "Claims Clearinghouse Market Share Report". 2023.

20. CISA. "ALPHV/BlackCat Ransomware Advisory". 2024.

Corrections log — 1 September 2026: A timeline entry dated Andrew Witty's congressional testimony to 22 March 2024 and described the $22M ransom as merely "considered". Witty testified on 1 May 2024, to the Senate Finance Committee and the House Energy & Commerce Oversight Subcommittee, and confirmed the ransom was paid. The duplicate hearing row was merged and the timeline re-sorted chronologically. The affected-population figure, previously carried as "100M+ ... pending final count", was updated to the final 192.7 million notified to HHS OCR on 31 July 2025, with the intermediate revisions added to the timeline.