Change Healthcare and Health System Risk

The February 2024 ransomware attack on Change Healthcare became a case study in market concentration and systemic risk in healthcare. The incident is considered the largest healthcare breach in U.S. history and may have affected about 190 million people, according to a legal analysis by Axinn, Veltrop & Harkrider LLP.

Operational dependence

The legal review focuses on the reliance on a single intermediary for critical billing and clinical payment functions. The analysis argues that this level of concentration pushed the regulatory debate toward the antitrust implications of the episode, because a single attack ended up affecting core processes for hospitals, providers and patients.

At the same time, a cybersecurity sector analysis cited by Help Net Security estimated the incident's total damage, including operational disruptions and reputational losses, at about $2.87 billion. That figure far exceeds the ransom paid and shows the systemic cost a single ransomware attack can impose on the U.S. healthcare system beyond the extortion amount.

A recurring pattern in healthcare

The Change Healthcare case adds to other campaigns against the U.S. healthcare sector. The investigative angle also includes attacks on hospitals such as University of Mississippi Medical Center and campaigns against home health agencies, a set of incidents that points to the structural vulnerability of the system to digital extortion and the disruption of critical services.

In that context, the episode became more than a cybersecurity incident and turned into a reference point for what happens when a central piece of the healthcare chain goes offline. The discussion is no longer limited to the ransom or the initial intrusion, but to the domino effect on billing, payments and operational continuity across the network.