The Change Healthcare Hack: Could a Vendor Outage Stop Your Business?

Your computers can be working normally while a cyberattack somewhere else stops an important part of your business. That is one of the lasting lessons of the February 2024 Change Healthcare ransomware attack.

For a medical practice, the interruption might be a claims or payment service. For another business, it could be payroll, online reservations, a supplier portal or the software used to schedule crews. A useful preparedness plan starts by identifying those dependencies.

How an attack spread beyond one company’s operations

In May 1, 2024 congressional testimony, then-UnitedHealth Group CEO Andrew Witty described how criminals used compromised credentials to enter a Change Healthcare remote-access portal on February 12. He said that portal lacked multifactor authentication. Ransomware was deployed on February 21, and the company disconnected affected environments.

Witty’s account described disruption to claims and payments, including manual work for pharmacists and financial pressure on providers. This is a retrospective on that incident, rather than a report of a new attack or a current outage.

The lesson extends beyond the organization that was breached. An outside service can be important enough that losing it interrupts revenue, customer service or routine work even when your own equipment remains available.

Start with the work you cannot afford to lose

Bring operations, finance and IT into the same conversation. Choose one essential activity, such as paying staff or collecting money, and trace every service it depends on. A name on a vendor list is less useful than knowing exactly what stops if that service disappears.

The NIST Small Business Quick-Start Guide recommends inventorying systems and services and considering the business impact of losing access. For a Hampton Roads company, a simple worksheet can turn that guidance into decisions:

• Essential activity: What must continue today, even during an outage?
• Dependency: Which outside system, account or provider makes it possible?
• Workaround: Is there an approved alternative, and has someone actually tried it?
• Time limit: When would delays become an unacceptable problem?
• Owner: Who has the authority and information to activate the alternative?

Test recovery before you need it

Having a backup and being able to resume work are different milestones. Ask your provider to demonstrate a restoration of a representative file or system and explain what the test does—and does not—prove.

The federal #StopRansomware Guide recommends offline, encrypted backups and regular recovery testing. It also advises organizations using outside backup providers to confirm that those providers follow appropriate practices. These checks belong in an ongoing service review.

Data exposure needs its own attention. Restoring files does not undo a theft of information. The same federal guide explains that attackers may steal data and threaten publication as well as encrypting systems. A response plan needs both operational recovery and a process for assessing what information may have been exposed.

Make the plan usable during a bad morning

Try a short tabletop exercise: the billing service is unavailable, the usual contact is not responding, and customers are asking questions. Decide who verifies the incident, who tracks the impact, who approves temporary procedures and who communicates with customers.

Keep an accessible contact list for key vendors and the people authorized to make decisions. Discuss cash-flow contingencies with your finance team before a delay in collections becomes urgent. For healthcare organizations, any workaround involving patient information should be reviewed by the responsible privacy and security staff.

The goal is a plan that a real person can follow under pressure. Specific responsibilities and a tested alternative are easier to use than a general promise that the provider “handles security.”

For a related conversation about who investigates alerts and coordinates response, read CVA’s takeaways from PwC’s David Klotz and his team. Explore more practical guidance in Technology & Cybersecurity.

Historical case study and general business preparedness guidance. Sources reviewed November 2, 2026.