Change Healthcare Breach: How UnitedHealth Communicated

The Change Healthcare breach began on February 21, 2024, when the ALPHV/BlackCat ransomware group attacked the UnitedHealth Group subsidiary. UnitedHealth communicated in stages: it reported on March 1 that the attackers called themselves ALPHV/BlackCat, confirmed a $22 million ransom payment on April 25, and by January 2025 TechCrunch reported the breach affected about 190 million people.

What happened at Change Healthcare in February 2024?

The ALPHV/BlackCat group attacked Change Healthcare on February 21, 2024, and UnitedHealth's Optum unit listed more than 100 affected services, according to MSSP Alert's event timeline. KSTP reported that some hospitals, doctor's offices and pharmacies were paralyzed.

Andrew Witty, UnitedHealth Group's chief executive at the time, told the Senate Finance Committee that the attackers used compromised credentials to enter a Citrix portal that had no multifactor authentication, as News5 Cleveland reported. MSSP Alert also reported that UnitedHealth funneled about $6 billion in advance funding and loans to providers hit by the outage.

How did UnitedHealth disclose the number of people affected?

UnitedHealth disclosed the number of people affected in stages, and each stage raised the figure. The three public steps below show how a description turned into a count.

The first statement described a share of the population and gave no count. When TechCrunch asked about the likely total, a UnitedHealth spokesperson did not dispute it and said the data review was ongoing. EPR's reading is that an open description of this kind leaves reporters to supply the number, and every later revision becomes a new story.

Why did the ransom confirmation shape UnitedHealth's credibility?

UnitedHealth let reports of a $22 million ransom stand for weeks before confirming the payment on April 25, 2024. In March, KSTP noted that multiple reports said UnitedHealth appeared to have paid the ransom, which the company had not confirmed.

Witty later claimed full responsibility for the decision to pay, according to MSSP Alert. The confirmation did not close the matter: TechCrunch reported that the ALPHV group disappeared in early March in an apparent exit scam, and that the affiliate behind the attack said the stolen data was still in its hands. UnitedHealth was then explaining a payment that had not clearly ended the extortion risk.

What can communications teams take from the Change Healthcare breach?

Communications teams can take three rules from the Change Healthcare breach: publish a number range early, confirm payment decisions before reporters do, and explain the control failure in the company's own words.

A range published early limits how many times the headline number can grow. TechCrunch's timeline carries versions dated August 2024, December 2024 and January 2025, which shows how long a rising count kept the story in circulation.

A payment confirmed by the company ends the guessing about it. The weeks between the March reports and the April 25 confirmation gave the story a gap that outside sources filled.

A control failure explained by the company shapes the framing. The detail about missing multifactor authentication reached the public record through Senate testimony. The first 48 hours matter for this reason, as the 48-hour breach window analysis explains, and a written cybersecurity crisis communications plan should assign the number, payment and control-failure statements before an incident starts.

For other cases in the same category, see the data breach communications archive. The Equifax breach case study covers another breach whose disclosed scale grew over time, and the healthcare coverage hub collects related health sector pages.

The through-line is sequence. UnitedHealth's facts were public within months, but the order in which they arrived, an attacker's name, a ransom, then a count that kept growing, set how the company was covered.