The legal aftershocks of the February 2024 Change Healthcare intrusion continue to define how healthcare breach fallout is handled in the United States. A federal court overseeing the multidistrict litigation (MDL) has now set strict rules governing how the stolen Change Healthcare dataset may be accessed, stored, and used during litigation — a direct consequence of both the extraordinary volume of data exfiltrated and the extreme sensitivity of protected health information (PHI) covering what is believed to be a substantial portion of the American population.
For defenders, this is not merely a legal footnote. It is a forcing function. When a federal judge concludes that breached healthcare data is so sensitive that even plaintiffs' attorneys and expert witnesses require court-mandated handling protocols — encryption at rest, access restrictions, prohibitions on copying or redistribution — that tells every CISO in the healthcare ecosystem exactly how regulators, courts, and plaintiffs will evaluate their data stewardship going forward. The standard of care is being written in real time, and organizations that cannot demonstrate rigorous PHI protection, segmentation, and breach evidence preservation will find themselves on the wrong side of it.
Background: Why This Dataset Is Different
Change Healthcare, a UnitedHealth Group subsidiary, processes an estimated 15 billion healthcare transactions annually and touches roughly one in three U.S. patient records. When the ALPHV/BlackCat ransomware affiliate gained access in February 2024 — reportedly through a Citrix remote access portal protected by a single user account without multi-factor authentication — the attackers had days of undetected dwell time before deploying encryption. The result was both a devastating operational outage that crippled claims processing nationwide and one of the largest PHI exfiltration events in history. UnitedHealth's own disclosures put the affected population at approximately 100 million individuals.
The new MDL ruling acknowledges what every IR practitioner already knows: this dataset is toxic. It contains names, Social Security numbers, dates of birth, diagnoses, treatment records, insurance details, and financial data. The court's protocols — restricting who may touch the data, requiring secure storage, limiting reproduction, and controlling disposal — mirror the controls that should have protected this data in production.
Technical Analysis: The Intrusion Chain Defenders Should Still Be Hunting
The Change Healthcare intrusion remains the canonical case study for how a single identity control failure cascades into catastrophic loss. No CVE was required — the attack chain relied on credential abuse and living-off-the-land techniques:
- Initial access: Stolen credentials against an internet-facing Citrix remote access portal lacking MFA. No exploit, no zero-day — just a valid session.
- Persistence and staging: Approximately nine days of dwell time, during which the attackers moved laterally, staged data, and prepared exfiltration channels using remote access tooling consistent with ALPHV/BlackCat affiliate tradecraft (RMM tools such as ScreenConnect/AnyDesk-style utilities are a documented staple of this ecosystem).
- Exfiltration: Bulk theft of PHI prior to encryption — the double-extortion model. The stolen dataset is precisely what the MDL court is now fencing off.
- Impact: Ransomware deployment against production systems, disrupting claims, pharmacy, and payment operations nationwide.
Exploitation status: This is not theoretical. The intrusion was confirmed, a $22 million ransom was reportedly paid, and ALPHV/BlackCat's successor ecosystem (including groups that absorbed its affiliates after the group's exit scam) remains one of the most active ransomware threats to healthcare in 2025–2026. The technique — credential-only access against MFA-less remote access infrastructure — is still being exploited against healthcare organizations today. If your perimeter includes a VPN concentrator, Citrix Gateway, or RMM agent without enforced MFA and conditional access, you are presenting the exact attack surface that produced this breach.
Detection & Response
The rules below target the behaviors that defined this intrusion chain: MFA-less remote access authentication, unauthorized RMM tooling, bulk data staging, and mass file encryption. They are deliberately scoped to minimize noise — validate against your environment's baseline RMM inventory before deploying at high severity.
---
title: Authentication to Remote Access Portal Without MFA Evidence
id: 3f8a2c91-7b4d-4e5f-9a21-6c8d0e1f2a3b
status: experimental
description: Detects successful logons to VPN/Citrix/remote access infrastructure where no MFA challenge artifact is present, matching the Change Healthcare initial access vector via a Citrix portal lacking MFA.
references:
- https://attack.mitre.org/techniques/T1078/
- https://attack.mitre.org/techniques/T1133/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.initial_access
- attack.t1078
- attack.t1133
logsource:
category: authentication
product: windows
detection:
selection:
LogonType:
- 3
- 10
filter_mfa:
AuthenticationPackageName:
- 'MfaAdapter'
- 'AzureMfa'
condition: selection and not filter_mfa
falsepositives:
- Service accounts with documented exemptions
- Legacy systems under compensating controls
level: high
---
title: Unauthorized Remote Monitoring and Management Tool Execution
id: 9c1e4b72-3a5f-4d68-8b17-2e6f9a0c4d5e
status: experimental
description: Detects execution of RMM tools commonly abused by ransomware affiliates (ALPHV/BlackCat ecosystem) for persistence and lateral movement. Tune the allowlist to your sanctioned RMM platform.
references:
- https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.command_and_control
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection_image:
Image|endswith:
- '\ScreenConnect.ClientService.exe'
- '\ScreenConnect.WindowsClient.exe'
- '\AnyDesk.exe'
- '\TeamViewer.exe'
- '\splashtop.exe'
- '\SRManager.exe'
- '\AteraAgent.exe'
- '\dwagent.exe'
- '\rustdesk.exe'
filter_sanctioned:
CommandLine|contains:
- 'C:\\Program Files\\YourSanctionedRMM\\'
condition: selection_image and not filter_sanctioned
falsepositives:
- Help desk tooling not yet in the allowlist
level: high
---
title: Bulk File Rename Indicative of Mass Encryption
id: 5d7f3a18-2c6e-4b91-a834-8f1c5d9e7b2a
status: experimental
description: Detects high-volume file modification activity on a single host consistent with ransomware encryption behavior, as deployed against Change Healthcare production systems.
references:
- https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.impact
- attack.t1486
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- '\rundll32.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\powershell.exe'
- '\cmd.exe'
condition: selection
falsepositives:
- Legitimate bulk file operations by administrators or backup software — correlate with volume thresholds in your SIEM (e.g. >500 file rename events per process per minute)
level: high
// Hunt: MFA-less remote access + suspicious RMM + staging behaviors (Change Healthcare intrusion chain)
// Part 1: Successful external authentications lacking strong auth method claims
SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType == 0
| extend AuthDetail = tostring(AuthenticationDetails)
| where AuthDetail !has "MFA" and AuthDetail !has "multifactor"
| where AppDisplayName has_any ("VPN", "Citrix", "Gateway", "Remote")
| summarize SignIns=count(), DistinctIPs=dcount(IPAddress), IPs=make_set(IPAddress)
by UserPrincipalName, AppDisplayName, bin(TimeGenerated, 1d)
| where SignIns > 0
| sort by TimeGenerated desc;
// Part 2: RMM tool execution on endpoints
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName has_any ("ScreenConnect", "AnyDesk", "TeamViewer", "splashtop",
"AteraAgent", "dwagent", "rustdesk", "SRManager")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
InitiatingProcessAccountName, FolderPath, SHA256
| sort by TimeGenerated desc;
// Part 3: High-volume outbound transfer from clinical/claims servers (exfil staging)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| summarize Connections=count(), RemoteIPs=make_set(RemoteIP), Ports=make_set(RemotePort)
by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where Connections > 500
| sort by Connections desc
-- Hunt for RMM persistence artifacts and ransomware staging on Windows endpoints
-- Part 1: Running processes matching affiliate RMM tradecraft
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(screenconnect|anydesk|teamviewer|splashtop|atera|dwagent|rustdesk)'
OR CommandLine =~ '(?i)(screenconnect|anydesk|teamviewer|splashtop)'
-- Part 2: Persistence via Run keys and services pointing outside sanctioned paths
SELECT Name, Data, Key.FullPath AS RegPath
FROM glob(globs='HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*',
accessor='registry')
WHERE Data =~ '(?i)(screenconnect|anydesk|temp\\|appdata\\roaming\\[a-z0-9]{6,})'
-- Part 3: Ransom notes and recently modified high-entropy file extensions
SELECT FullPath, Size, Mtime
FROM glob(globs='**/RECOVER-*.txt',
accessor='ntfs')
WHERE Mtime > now() - 1209600
# Change Healthcare lesson-learned hardening verification script
# Run on a management host with appropriate read access
# 1. Verify MFA enforcement on all Entra ID / AD accounts with remote access rights
# (Requires Microsoft.Graph module)
Connect-MgGraph -Scopes "User.Read.All","Policy.Read.All" -NoWelcome
$mfaReport = Get-MgUser -All -Property "Id,UserPrincipalName,AccountEnabled" |
Where-Object { $_.AccountEnabled -eq $true } |
ForEach-Object {
$methods = Get-MgUserAuthenticationMethod -UserId $_.Id
[PSCustomObject]@{
UserPrincipalName = $_.UserPrincipalName
MFARegistered = ($methods.Count -gt 1)
}
}
$mfaReport | Where-Object { -not $_.MFARegistered } |
Export-Csv -Path ".\Accounts_Without_MFA.csv" -NoTypeInformation
Write-Host "Accounts without MFA exported to Accounts_Without_MFA.csv — remediate immediately."
# 2. Audit for unauthorized RMM binaries across the fleet (sample per-host check)
$rmmPatterns = @('ScreenConnect','AnyDesk','TeamViewer','splashtop','AteraAgent','dwagent','rustdesk')
Get-ChildItem -Path 'C:\Program Files','C:\Program Files (x86)',"$env:ProgramData" -Recurse -ErrorAction SilentlyContinue |
Where-Object { $n=$_.Name; $rmmPatterns | Where-Object { $n -match $_ } } |
Select-Object FullName, LastWriteTime |
Export-Csv -Path ".\RMM_Audit.csv" -NoTypeInformation
# 3. Confirm Citrix/VPN portal MFA: verify no RADIUS bypass or LDAP-only fallback exists
Get-ChildItem 'HKLM:\SOFTWARE\Citrix' -ErrorAction SilentlyContinue | Out-Null
Write-Host "Manually verify: Citrix Gateway vServer bound to nFactor/MFA policy; no LDAP-only authentication action."
# 4. Enable advanced audit policy for bulk file access (encryption early warning)
auditpol /set /subcategory:"Detailed File Share" /success:enable /failure:enable
auditpol /set /subcategory:"File System" /success:enable /failure:enable
Remediation and Defensive Priorities
The court's data handling order is a mirror. Apply the same rigor inside your environment that a federal judge now demands of litigants:
- Enforce MFA on every remote access pathway — no exceptions. The Change Healthcare intrusion began with a single MFA-less Citrix account. Audit Citrix Gateway, VPN concentrators, RDP gateways, and third-party RMM platforms for accounts exempt from MFA. This is the single highest-value control and should be treated as an emergency item, not a roadmap item.
- Inventory and control RMM tooling. Establish a sanctioned-RMM allowlist, alert on everything else, and block unauthorized RMM binaries via application control (WDAC/AppLocker). Ransomware affiliates live inside RMM tooling precisely because it blends in.
- Segment PHI repositories. Bulk exfiltration of 100 million records requires flat network access to aggregated data stores. Implement network segmentation between claims/clinical data platforms and general corporate IT, and apply DLP egress controls on database-tier subnets.
- Reduce dwell time. Nine days of undetected access is the difference between an incident and a catastrophe. Deploy the detections above, and ensure authentication telemetry from remote access infrastructure is actually reaching your SIEM — this is routinely misconfigured.
- Prepare for the litigation standard of care. The MDL rules show how courts now treat breached PHI: chain of custody, encryption at rest, access logging, controlled disposal. Your incident response plan must include forensic evidence preservation and breach data handling procedures that would survive this scrutiny. Retain counsel with healthcare breach MDL experience before you need them.
- HIPAA Security Rule alignment. HHS OCR's enforcement posture and the proposed HIPAA Security Rule update (mandatory MFA, encryption, network segmentation, asset inventories) directly encode the lessons of this breach. Map your controls to NIST CSF 2.0 and CIS Controls v8 now — compliance frameworks are converging on what this incident proved necessary.
The Bottom Line
When a court treats a stolen dataset like hazardous material, the message to defenders is unambiguous: PHI at rest is a liability that compounds every day it remains unsegmented, unmonitored, and reachable through an MFA-less portal. The Change Healthcare breach was not an exotic zero-day story — it was a basic identity hygiene failure with nation-scale consequences. The organizations that internalize that lesson, and can prove their controls to auditors, regulators, and eventually courts, are the ones that will not be writing their own MDL chapter.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.