Change Healthcare
The February 2024 attack on a US health-payments platform, the archetype of cyber accumulation through a shared vendor.
On February 21, 2024, the ALPHV/BlackCat gang deployed ransomware at Change Healthcare, the UnitedHealth Group unit that touches roughly one in three US patient records. The attackers had gotten in on February 12 through a Citrix remote access portal with no multifactor authentication. CEO Andrew Witty told the Senate so on May 1, 2024, while confirming a $22 million ransom. Around 192.7 million people were affected, more than half the US population, and 94% of hospitals surveyed by the American Hospital Association reported a financial hit. For a cyber underwriter it is the textbook case of accumulation through a shared vendor. You can pick your hospitals one by one, controls checked, and watch them go down the same day through a link none of them controls. Per-insured diversification does nothing when the whole book runs through one platform. In these files, dependent business interruption, often sublimited in market wordings, becomes the line that matters.
Textbook case: a cyber insurer that had carefully selected its insured hospitals nonetheless suffered a correlated loss during the February 2024 attack on Change Healthcare, because all of them depended on the same payments platform.
Change Healthcare attack, Change Healthcare ransomware, ALPHV 2024
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.