Public cyber incident analysis · 2024
Change Healthcare: one digital dependency, far-reaching disruption
This case separates three measures that are often conflated: service recovery, people affected by the breach and financial impact. Each has its own scope and date.
Analysis of a public incident, not a CyberUP client reference. Disclosures, documents and operational interpretation.
At a glance
Three measures. Different meanings.
Figures and dates come from the cited sources. They are not results from a CyberUP exercise.
The documented record
Facts and scope.
Entry and response, as described in testimony
In its testimony on 1 May 2024, UnitedHealth Group described a Citrix portal without multifactor authentication, lateral movement and data theft. The account distinguishes initial access from the ransomware deployment nine days later. It identified pharmacies, payments and claims as recovery priorities, and described alternative processing arrangements and financial support for providers. [1]
Costs and people: what the figures measure
The 2024 results report response costs separately from the revenue impact. Provider financing and advances are not a third loss category to add to the total. The HHS FAQ also distinguishes people affected from notices sent: the earlier figure of 190 million was a January 2025 update, not the latest figure in the FAQ reviewed. [2] [3]
Key dates
The documented timeline.
A service dependency extends beyond the supplier’s boundary
For a readiness simulation, we propose starting with the service that must continue, not the inventory of systems the organisation owns. An organisation may depend on an intermediary without controlling its recovery. The exercise therefore needs to include alternatives, remaining capacity and external stakeholders.
For Operations, the question is which workflows can continue through alternative arrangements, and at what capacity. For Finance, it is the exposure created by delayed receipts or payments. For data owners, it is the information needed to establish who is affected. The answers will differ across organisations.
An exercise can give different updates to different functions and ask the crisis team to reconcile them. Connectivity may return before claims have been reconciled; the affected-population figure may change after notifications begin. The objective is to test how those distinctions are approved and communicated.
This proposal makes no claim about whether providers in this incident had these capabilities. It is designed to test the relationship between technical availability, service continuity and consequence management within the participant’s own programme.
From incident analysis to readiness
Three questions to test.
Exercise ideas for your organisation. They do not describe work carried out by CyberUP for the organisation discussed.
Which dependency is outside our control?
Identify an essential external service and an alternative operating arrangement. Check capacity, ownership and the information needed to activate it.
What does “restored” mean?
Distinguish reopening a channel from clearing its backlog and reconciling transactions. Do not use a single status for different conditions.
Who owns figures that keep changing?
Assign ownership of financial and data-impact metrics. Changes must remain traceable without erasing the scope of the previous assessment.
Source record
Sources and further reading.
Source dates and the period covered are distinct from this page’s source-review date. CyberUP interpretations are labelled as such. External sources do not imply endorsement or a commercial relationship.
- UnitedHealth Group · US House of Representatives · 1 May 2024
Written testimony of Andrew Witty (opens in a new tab)Primary testimony · PDF. PDF pages 4–9: entry, response, recovery and provider support. The company’s account as presented at the hearing. - UnitedHealth Group · 16 January 2025
Full-year 2024 results (opens in a new tab)Primary company results · PDF. PDF page 12: annual table and notes on direct response costs and reduced revenue. - HHS · Office for Civil Rights · Reviewed 13 August 2025
Change Healthcare FAQ, question 11 (opens in a new tab)Primary government source. Affected-population figure reported to OCR on 31 July 2025. Distinguishes people affected from notices sent.