The Vendor You Never Heard Of Just Breached Your Patients’ Data 

How third-party systems became healthcare’s biggest cybersecurity crisis — and what every physician needs to understand right now 

On February 21, 2024, a ransomware group called BlackCat pressed “go” on an attack that had nothing to do with any hospital, clinic, or physician practice — and yet managed to financially devastate tens of thousands of them across the United States within days. 

The target was Change Healthcare, a billing and claims clearinghouse that most patients had never heard of and most doctors barely thought about. But Change Healthcare processed roughly half of all medical claims in the United States — touching one in every three patient records, handling $2 trillion in annual transactions, connecting approximately 900,000 physicians, 33,000 pharmacies, 5,500 hospitals, and 600 laboratories to the insurance infrastructure that pays them. When the attack hit and Change’s systems went dark, the entire billing engine of American medicine stalled simultaneously. 

How did attackers get in? Not through some sophisticated zero-day exploit or nation-state cyberweapon. They logged in through a remote access portal that was not protected by multi-factor authentication. A single missing security control. The rest was gravity.