Change Healthcare hacked using stolen Citrix account with no MFA

UnitedHealth confirms that Change Healthcare's network was breached by the BlackCat ransomware gang, who used stolen credentials to log into the company's Citrix remote access service, which did not have multi-factor authentication enabled. [...]

access account authentication blackcat blackcat ransomware breached change change healthcare citrix credentials factor gang hacked healthcare log mfa multi-factor multi-factor authentication network ransomware ransomware gang remote access security service stolen stolen credentials the company unitedhealth