Change Healthcare, compromised by stolen credentials, did not have MFA turned on
This Cybersecurity Dive article, published April 30, 2024, reports that Change Healthcare was compromised by stolen credentials on a remote access portal lacking multifactor authentication. Casey Ellis, founder of Bugcrowd, says MFA would likely have prevented the attack chain and that the software itself was probably not the initial access problem.
Source description, as published
AlphV deployed ransomware nine days after it used access to a Citrix portal on Change’s network to move laterally within systems, CEO Andrew Witty said in testimony prepared for a House subcommittee hearing set for Wednesday.