Change Healthcare: The historical lesson that demonstrates how to 24Cevent would have saved the health care system of the U.S.

February 2024 – 2 years ago

Through the night, 190 million people lost access to their medical records.

Pharmacies could not process recipes.
The hospitals were unable to access patient records.
The laboratories were not able to report results.

The health system of the US came to a standstill.

Change Healthcare, a company that processes about 15% of all transactions on medical in the U.S., was attacked with ransomware. What happened after, and 4 months of partial stoppage, chaos, national, and loss of thousands of millions, is the most important lesson about why real-time detection is not optional for critical infrastructure.

The incident (February 2024)

What happened

FACT: Change Healthcare was attacked with ransomware. The company is responsible for processing:

• Insurance claims
• Transactions of pharmacy
• Processing of payments in health
• Patient records

FACT: The ransomware encrypted critical systems. Change Healthcare has lost access to their own infrastructure.

FACT: 190 million people (about 60% of the U.S. population) had data exposed or compromised systems.

The immediate impact

• Pharmacies: could Not process recipes of insurance. Patients had to pay in cash.
• Hospitals: could Not access patient records. Services elective were cancelled.
• Laboratories: could Not report results to physicians.
• Insurance: could Not process claims.

For weeks, the health system worked in ‘manual mode’ back-to-paper, back to calls, back to chaos.

Recovery

Change Healthcare it took 4 months to recover completely. But even after:

• Systems partially degraded by months
• Loss of confidence in the company
• Regulators investigating
• Lawsuits of hospitals and patients
• Estimate: more than $1,000 million in total losses (including rescue, recovery, lawsuits, loss of reputation)

Why it was possible to

The access vector (historical analysis)

SPECULATION CONTROLLED (Change Healthcare has not disclosed fully the vector, but patterns suggest):

• Initial access probably via vulnerability in system VPN or web service exposed
• Or credentials compromised employee
• Or prior recognition for weeks/months

FACT: once the attacker had access to the initial, failed to:

• To make recognition of the infrastructure
• Move laterally through systems
• Getting to critical systems without being detected
• Install ransomware

Vulnerability: Lack of correlation

ANALYSIS: To Change Healthcare will not detect the attack for months (before encryption end), this means that:

1. There was No correlation between indicators:
   • Access to abnormal detected (alert ignored)
   • Recognition of detected network (alerts ignored)
   • Lateral movement detected (alert ignored)
   • Each system saw ‘noise’, no one saw the ‘pattern’
2. Not had prioritization of alerts:
   • Hundreds or thousands of alerts per day
   • Humans may not be correlated
   • Critical signals are lost in the noise
3. He had not automated response:
   • Even if someone saw something weird, I had to:
     • To investigate manually
     • To make that decision escalation
     • Notify the right people
     • Everything used to take hours or days

The attack phases (historical reconstruction)

Phase 1: initial Access (Weeks 1-2)

The attacker enters. Probably:

• Exploits a vulnerability in VPN
• Or credentials compromised
• Establishes foothold minimum

Indicators that nobody correlated:

• Access from unknown location
• Attempts to access internal services
• Queries anomalous databases

Without 24Cevent: individual Alerts generated, not correlated
With 24Cevent: ‘Multiple indicators = immediate investigation’

Phase 2: Recognition (Weeks 2-6)

The attacker mapped to the infrastructure. Identifies:

• Where is stored the data critical
• What systems they control what
• How to move sideways
• How to evade detection

Indicators:

• Network scanning (list of ports)
• Attempts to access multiple systems
• Queries to directories such as Active Directory
• Downloads of information about users

Without 24Cevent: individual Alerts, probably many, human can not continue
With 24Cevent: ‘Pattern recognition detected = Incident Level: HIGH’

Phase 3: lateral Movement (Weeks 6-10)

The attacker moves through the network. Using stolen credentials or exploits, privilege escalation, go to:

• Data servers
• Backup systems
• Domain controllers
• Administrative servers

Indicators:

• User movement between systems unusual
• Privilege escalation anomalous
• Directory access is not normal for that user
• Activity during off hours

Without 24Cevent: Still noise, even without correlation
With 24Cevent: ‘privilege Escalation detected + lateral movement = CRITICAL IMMEDIATELY’

Phase 4: Preparation of an attack (Week 10-11)

The attacker:

• Disables backup systems
• Disables or configures malware detection
• Pre-positioned ransomware
• Coordinates timing

Indicators:

• Access to backup systems with the intent to modify
• Disabling security tools
• Uploading of executable files to critical systems
• Changes permissions on backup systems

Without 24Cevent: If someone sees something, it is too late, the attack is pre-positioned
With 24Cevent: ‘Attempt to disable backups = LOCKDOWN IMMEDIATELY’

Phase 5: Implementation (Week 11, night)

Ransomware is executed simultaneously on all critical systems. In minutes:

• Everything is encrypted
• Change Healthcare loses access to its own infrastructure
• The health care system of the U.S. enters into chaos

How to 24Cevent would have transformed the answer

Scenario 1: Detection of initial access

Week 1, when the attacker enters:

Indicators simultaneous:

• VPN: Access from IP list-gray/unknown
• Firewall: Connection to port anomalous
• AD (Active Directory): authentication Failures followed by success
• SIEM: Query to data base of patients

Without 24Cevent:

• VPN team sees access strange, makes mental note
• Firewall team sees a connection strange, generates ticket
• AD team sees authentication failures (normal/noise)
• SIEM team looks query strange (possibly ignored)

No one connects the dots. Attacker continues.

With 24Cevent:

• Correlation instant: ‘4 indicators anomalous simultaneously’
• Escalation automatic: ‘Pattern of incident = INVESTIGATE IMMEDIATELY’
• Auto answer: ‘Isolation of account in question + notification on-call’

Result: Attacker is detected in hours, not months. Foothold is removed.

Scenario 2: Detection recognition

Week 4, when the attacker is mapping infrastructure:

Indicators:

• Network: Port scanning from a compromised machine
• AD: Queries failed to enumerate users
• Firewall: Attempts to access multiple subnets
• Database: Queries data structure (information_schema, etc)

Without 24Cevent:

• Each team sees anomalous activity, but it is ‘noise’
• It is easy to ignore when there are thousands of alerts per day
• SIEM generates tickets, but without context, it is only ‘network scan’

With 24Cevent:

• Correlation: the ‘Port scanning + AD enumeration + DB schema queries = Recognition of infrastructure’
• Context: ‘From the machine that we have access to the initial 2 weeks ago’
• Escalation: ‘CRITICAL INCIDENT: Recognition post-initial access detected’
• Answer: Blocking the compromised machine, review backup of AD, audit queries

Result: Attacker is expelled in days, before being able to map infrastructure completely.

Scenario 3: Detecting attempts to turn off backups

Week 10, when the attacker tries to prepare for the final blow:

Indicators:

• Backup system: Access from unauthorized user
• AD: Changing permissions on backup systems
• Firewall: Backup system trying to contact external IP
• Alert: Security tool being turned off

Without 24Cevent:

• Backup team: ‘Who tried to change the backup? Locked ticket open’
• Security team: ‘why are you turned off the tool? Restarted, ticket open’
• AD team: ‘to Change permissions, audited, ‘ticket open’

Three tickets separated, possibly created by different people, possibly in different shifts. No one sees the pattern.

With 24Cevent:

• Correlation: ‘Attempt simultaneous access to backup + deactivation of the security tool + change permissions’
• Historical context: ‘From machine with access committed in the last 2+ months’
• Escalation: ‘CRITICAL INCIDENT IMMEDIATELY: Preparation of attack ransomware detected’
• Auto answer:
  • Isolation of network backup system
  • Restore AD to checkpoint previous
  • Immediate notification to CEO, CTO, CFO, regulators
  • Activation of response plan incident

Result: Ransomware is never executed. Change Healthcare completely avoids the incident.

Stage 4: Detection of ransomware (if running)

Week 11, when the ransomware is executed:

Indicators (first few seconds):

• File system: massive Creation of files with extension unknown
• IO: IOPS anomalous discs
• CPU: Activity cryptográfica anomalous (detectable by analysis of pattern)
• Network: Communication servers (C&C (if not encrypted)

Without 24Cevent:

• Sec team sees alert ‘files with extension unknown’ = probably false alarm
• Ops team sees IOPS height = probably is backup
• Safety analyses in parallel, it takes hours to connect

Result: Ransomware encrypts everything before being arrested.

With 24Cevent:

• Correlation: ‘massive Creation of files anomalous + IOPS anomalous + activity cryptographic’
• Escalation immediate: ‘RANSOMWARE IN PROGRESS’
• Auto answer (in seconds):
  • Isolation of network of the affected machine
  • Suspension of the process (if possible)
  • Snapshot of the current state (to examiner)
  • Failover to backup non-committed

Result: instead of encrypting the entire infrastructure, are encrypted only the files accessible before isolation (possibly <1% of the total).

The real cost: Comparison

Without 24Cevent (what happened):

• Detection time: Weeks/months
• Response time: Hours (too late)
• Scope of engagement: 190 million people, critical systems encrypted
• Downtime: 4 months of recovery
• Total cost: ~$1,000+ million
• Impact: System health of U.S. chaos

With 24Cevent (alternative scenario):

• Detection time: Hours to days (initial access)
• Response time: Minutes to hours (auto answer)
• Scope of engagement: 0 (attacker expelled before running ransomware)
• Downtime: 0 (or minimal, if any system needs to reset)
• Total cost: ~$1-5 million (research & remediation)
• Impact: Incident content, is not national news

The difference: Billions of dollars in economic impact direct + indirect in the economics of US health

The lesson for critical infrastructure

Change Healthcare demonstrates that:

1. The manual scan is too slow to attack multi-phase
2. The correlation human is impossible when there are 1,000+ daily alerts
3. The answer should be automatic, expect human decisions = too late
4. The early stages of the attack are detectable, reconnaissance, lateral movement, preparation

What was missing was a system that could:

• See indicators from multiple sources simultaneously
• To correlate them in a pattern
• To automatically scale
• Respond without waiting for human

That is 24Cevent.

SOURCES CHECKED:

• CyberLideria MGZN – 10 Attacks More Powerful 2024-2025
• ERMProtect – Top 2024 Cyber Incidents
• Netwrix – Biggest Cyber Attacks in History