How the Attack Occurred
Back to: Introduction to CyberSecurity
Photo by Declan Sun on Unsplash
When Optum acquired Change Healthcare, they neglected to double check the security measures that were already in place. As they were working to incorporate Change Healthcare’s system into their environment, attackers found the lack of Multi-Factor Authentication on the Citrix portal (an application used to enable remote access to desktop). Using stolen credentials, the hackers were able to gain initial access.
“Once the threat actor gained access, they moved laterally within the systems in more sophisticated ways and exfiltrated data. Ransomware was deployed nine days later.”