Change Healthcare ransomware incident on Feb 21, 2024 is real but not a production AI failure
A real ransomware incident at Change Healthcare occurred on February 21, 2024. It was not a production AI failure; MFA gaps on remote access were cited as a key root cause, with BlackCat identified as the attackers.
Ransomware breach at Change Healthcare was caused by MFA gaps on remote access, not a production AI failure.
Key facts
- What
- A real ransomware incident at Change Healthcare occurred on February 21, 2024.
- Incident date
- Feb 21, 2024
- Who
- Change Healthcare (a subsidiary of UnitedHealth Group/Optum)
- Failure mode
- Data Leakage
- AI surface
- Chatbot
- Severity
- Medium
What happened
On February 21, 2024, Change Healthcare experienced a ransomware attack that disrupted its systems and AI-driven claims processing. Security analyses attribute the breach to a lack of Multi-Factor Authentication on remote access servers, which allowed attackers to gain entry and encrypt data. The event is characterized as a cyberattack, not a malfunction or failure of the AI production models.
What broke inside the model
- 01 · TriggerA request triggers retrieval or context loading.
- 02 · Model stepThe context pulls in another user's content.
- 03 · Control gapNo boundary enforces isolation at the moment of output.
- 04 · FailurePrivate data crosses into the response.
- 05 · ConsequenceOne user sees another's data, and disclosure follows.
One user's content crosses the retrieval boundary into another's response.
The breach occurred when attackers gained entry through a remote access server with MFA disabled, allowing encryption of Change Healthcare's systems. The root cause cited is a lack of MFA on remote access servers, which HIPAA-related guidance indicates is a security deficiency. This led to a ransomware-driven outage rather than a failure of the AI processing itself.
What it cost
Sources
- PrimaryUnitedHealth Group Updates on Change Healthcare Cyberattackunitedhealthgroup.com
- PressBlackcat claims responsibility for cyberattack at UnitedHealthcnbc.com
Cite this entry
https://failureindex.ai/failures/change-healthcare-ransomware-incident-feb-2024AI Failure Index. "Change Healthcare ransomware incident on Feb 21, 2024 is real but not a production AI failure" (FI-0296). Realm Labs. https://failureindex.ai/failures/change-healthcare-ransomware-incident-feb-2024 (indexed Jun 5, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0296. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
- AI Detection & Response (AIDR)
Realm can detect when a response is about to emit data that falls outside the bounds of the current user and context, and block or redact it inline, at the moment of generation rather than after the data has left.