Most patients had never heard of Change Healthcare. It sits between pharmacies, doctors and insurers, and at the time it handled something like fifteen billion health-care transactions a year.
On 12 February 2024, someone logged in to one of its remote-access portals with a username and password that were not theirs. The portal did not ask for a second check. To the system, the login looked like an employee arriving for work. Over the next nine days the attackers moved through the network and copied data out. On 21 February they set off ransomware, and it reached the backup environments too.
UnitedHealth Group, which owned Change, took it offline to contain the attack. With Change offline, many providers could not check a patient’s coverage, submit claims or get paid, and some pharmacists filed claims by hand. UnitedHealth paid a ransom of 22 million dollars in bitcoin, and put the attack’s cost to itself for 2024 at about 3.1 billion dollars. The count of people potentially impacted grew over time, to about 192.7 million.
The video follows how that one login worked, why backups could bring the systems back but could not recall the copy already taken, what the public record says about who claimed the attack, and where the investigation and the lawsuits stood on 26 September 2026. None of those cases is a finding of wrongdoing.
