A cyberattack does more than create a bill and a reputation problem. It can stop work while it is happening. The ransomware attack on Change Healthcare is an example. Critical infrastructure means services such as healthcare, communications, travel, and utilities.
The attack
In February 2024, ransomware took down Change Healthcare, a U.S. medical-technology company that connects patients, providers, and insurers. Its platforms handle billing and insurance claims and serve 1 in 3 patients in the United States. The company had 15,000 employees. The effects spread through healthcare.
What stopped
Hospitals, pharmacies, and practices that depended on those platforms could not process insurance claims or manage billing in the usual way. Providers could not efficiently reach patient records or process prescriptions. Patients faced delayed treatment and could not refill prescriptions that depended on the affected systems.
The effects
Work falls back to manual steps
People revert to slower, more error-prone processes. That leads to missed deadlines, frustrated clients, and more strain on the staff.
The money
Recovery is expensive. In Change Healthcare’s case, the reported direct costs were more than $1.5 billion, including ransom payments and recovery. Paying is rarely the fix: fewer than half of companies that pay actually get their data back, and many attackers demand a second ransom and threaten to release stolen information. That is double extortion.
People outside the company
When the target is critical infrastructure, the damage moves through the industry. In healthcare, downtime can put lives at risk.
What to take from it
- Do the preventive work: keep systems updated, and train employees.
- Do not pay the ransom. Payment often leads to more extortion, with no promise that the data comes back.
- Have a contingency plan. An incident response plan can shorten downtime and reduce the disorder.
Healthcare, utilities, financial services, and transportation are attractive targets. The people who rely on those services feel the outage.
Back to the blog