The February 2024 attack on a US health-payments platform, the archetype of cyber accumulation through a shared vendor.
Change Healthcare is a health-payments processing platform used by almost all American establishments, whose ransomware compromise in February 2024 constituted the largest cyberattack in the history of American medicine. It affected around 192.7 million people, nearly two thirds of the population, and disrupted some 94 % of the country's care providers. The event became the emblematic illustration of accumulation through the vendor, where a single upstream compromise strikes thousands of insureds resting on the same infrastructure simultaneously. For cyber insurance, it reveals that the careful selection of each hospital does not protect against a correlated loss born of a shared link that no insured controls, which defies diversification.
A cyber insurer that had carefully selected its insured hospitals nonetheless suffered a correlated loss during the Change Healthcare attack, because all of them depended on the same payments platform.
attaque Change Healthcare