On 12 February 2024, someone signed in to a Change Healthcare Citrix remote access portal using credentials that were not theirs. There was no exploit. There was no zero-day. The portal was reachable from the internet, the credentials were valid, and multi-factor authentication was not enabled.
Ten days later, ransomware was deployed. The company later put the cost at $872 million, and the disruption reached pharmacy counters across the United States.
The reporting, correctly, focused on the missing MFA. It is worth looking one step earlier than that.
What actually happened
The sequence, from the company's own testimony, is short.
| Date | Event |
|---|---|
| 12 February 2024 | Attackers sign in to the Citrix portal with stolen credentials |
| 12 to 21 February | Ten days of access, reconnaissance and data exfiltration |
| 21 February 2024 | Ransomware deployed |
The credentials themselves were most likely taken by an information stealer or by phishing. That part is ordinary. Credentials leak constantly, and any security program that assumes otherwise is planning for a world that does not exist.
The gap: a login page is a service that answers strangers
A remote access portal has to be reachable by staff, so it is published. Once it is published it answers everyone, and every control behind it waits for a connection before it can do anything.
That produces a specific and uncomfortable property. When the attacker connected, from their own infrastructure, on a network belonging to nobody at Change Healthcare, the portal answered normally. It presented a login form. It accepted the credentials. It began a session.
Nothing went wrong. That is exactly the problem. A valid credential arriving at a service that answers everyone is indistinguishable from an employee starting work.
MFA would have added a step the attacker had to defeat, and its absence is a genuine failure. But notice what MFA is: a control that engages once a credential has already been presented to a service that has already answered. It raises the cost of the intrusion. It does not remove the opportunity.
Ten days of dwell time started at a successful login, which means the logs recorded a normal working session. There was no authentication failure to alert on, because authentication succeeded.
What would have had to be true for this to fail
Ask a narrower question than "how do we stop credential theft", because the answer to that one is that you cannot, entirely.
Ask instead: what would have had to be true for a valid credential, held by the wrong person, on an unrecognized network, to be worth nothing?
The portal would have had to not answer that network.
That is a decision Change Healthcare's own edge equipment was already capable of making. Firewalls and gateways have accepted source-based rules for decades. What was missing was not the capability. It was a current, accurate answer to the question of which networks the company's trusted people were actually connecting from at that moment, delivered without anybody maintaining a list by hand.
Where Veribound would have fitted
Veribound is an intelligence layer, not an enforcement point, and it replaces nothing in the picture above.
An agent on each staff device keeps confirming it is still the one the organization trusted. What reaches the company's firewall is a trusted origin: the network that device is connecting from, in practice its public address. Those arrive as address-group updates against the firewall policy the company already had.
Applied to this incident, the Citrix portal keeps running. Citrix keeps doing what Citrix does. The company's own firewall keeps enforcing its own rules. What changes is who the portal ever answers.
- The attacker's network is not a trusted origin, so the portal never presents a login form to it.
- The stolen credentials are still stolen, and still valid, and have nowhere to be typed.
- The missing MFA is still a gap, and it stops being the only thing standing between an attacker and a session.
Being clear about what this would not have done: it would not have prevented the credential theft. Information stealers and phishing are a different problem with different controls. What it changes is what a stolen credential is worth to somebody who is not on a network you trust, which in this case is the entire distance between a leaked password and $872 million.
Source: Change Healthcare hacked using stolen Citrix account with no MFA, BleepingComputer, 30 April 2024.