Why Change Healthcare’s missing MFA was a deal-integration failure

The week

On May 1, 2024, the chief executive of one of America’s largest companies sat in front of two committees of Congress and explained how a single unlocked door had stalled a large part of the country’s health care payments system.

Andrew Witty, chief executive of UnitedHealth Group, testified that morning before the Senate Finance Committee, chaired by Ron Wyden, with Mike Crapo as ranking member. In the afternoon he appeared before the Oversight and Investigations Subcommittee of the House Energy and Commerce Committee. Its hearing was titled “Examining the Change Healthcare Cyberattack.” Both sessions were about the February ransomware attack on the company’s Change Healthcare unit. Ransomware is criminal software that scrambles an organization’s files and systems so they cannot be used, followed by a demand for payment to unlock them, often with a threat to publish stolen data as well. Change Healthcare is a business most patients have never heard of, but it handles a vast number of the transactions between doctors, pharmacies and insurers: eligibility checks, claims, payments and pharmacy approvals.

Witty’s written testimony set out a timeline. On February 12, criminals used compromised credentials, meaning a real username and password that had fallen into the wrong hands, to log in to a Change Healthcare Citrix portal. Citrix makes software that lets staff reach their work desktop remotely, from home or on the road, through a web page. That portal, the testimony said, did not have multi-factor authentication, or MFA. MFA is the familiar second step after a password, such as a code sent to a phone or a tap on an app, that proves the person logging in is who they claim to be. Without it, a stolen password alone was enough to walk in.

Once inside, the attackers moved laterally through the systems and took copies of data. Nine days later, on the morning of February 21, a criminal group calling itself ALPHV or BlackCat deployed ransomware that encrypted Change’s systems. Not yet knowing how the attackers had entered, UnitedHealth cut connectivity to Change’s data centers. The testimony said there was no evidence the malware spread beyond Change, to the rest of UnitedHealth or to customers. The cost of that containment was that Change’s services went dark for the providers that relied on them.

The rebuild was large. The testimony described experts from several major technology and security firms joining Change’s teams in Nashville. Together they replaced thousands of laptops, rotated credentials and rebuilt the data center network and core services. Pharmacy claims were prioritized and largely restored by early March. Payment processing was still below its pre-attack level at the end of April. By April 26, the company said, it had advanced more than $6.5 billion in accelerated payments and interest-free loans to providers whose cash flow had stopped.

Witty confirmed under questioning that the company had paid a ransom of $22 million, in bitcoin, and said the decision was his. He told House members that the stolen files might cover the health and personal information of perhaps a third of Americans, while stressing that the review was far from finished. A week earlier, on April 22, UnitedHealth had said that stolen files contained protected health information that could cover a substantial proportion of people in America. It added that screenshots of some files had been posted online.

He also explained something that matters a great deal for any organization that grows by acquisition. UnitedHealth had acquired Change Healthcare in October 2022, after a federal court rejected the Justice Department’s attempt to block the deal. Witty described Change as an older company with older technology that UnitedHealth had been upgrading since closing. In written answers to senators’ follow-up questions, later published by the committee, the company said its own policies and Change’s already required MFA on external-facing applications. The server at issue was a legacy Change Healthcare server that the team was working to bring up to UnitedHealth’s standards. The company added that it applies a baseline set of controls to each new acquisition, but that systems layered over four decades take time to bring into line. The parent company’s rules applied on paper, but the acquired business had not yet been fully moved onto the parent’s systems and controls.

Senators from both parties pressed him on a simple question: how could such a basic protection be missing at a company so central to US health care payments? It was an uncomfortable moment, and a revealing one. The missing control was hardly exotic; almost every large organization already requires it. The federal health department had already opened an investigation in March into whether Change and UnitedHealth had complied with HIPAA, the federal law that sets privacy and security rules for health information. The gap the hearings exposed lay in the timing, in the months between buying a company and truly absorbing it.

The Change Healthcare outage hit customers first: many providers faced a hard decision about disconnecting from Change Healthcare, and then a cash crisis when claims and payments stopped flowing. The May testimony answered a different question, about the company itself: how the door got left open.

The answer is not that nobody knew MFA mattered. Almost every large health care organization already required MFA for remote access, at least on paper, and UnitedHealth’s own policy did. The gap existed because Change Healthcare was in the window between a deal closing and a security program arriving. Health care keeps consolidating, with hospital systems, insurers, physician groups and technology vendors buying one another, so that window is a recurring exposure rather than a one-off accident. It has three stages: what a buyer learns before closing, what it controls in the interim, and what it can prove afterward to its board and customers.

Before those three stages, a short account of the doors themselves, because the stages only make sense once it is clear what a buyer is trying to find. After them come what the open door cost, the habits that separate buyers who handle the window well, and the questions a leader can ask before the next deal.

Every building has more than one door

Every organization of any size has what security people call an “attack surface.” The phrase sounds technical, but the idea is simple. It is the set of places where the outside world can reach in. A large office building is a fair comparison. It has a front entrance with a reception desk, but it also has a loading dock, a fire exit, a side door for the cleaning contractor and perhaps a gate to the parking garage. A burglar does not care which door is grandest. They care which one is unlocked.

In a company’s technology, the doors are the login pages and connection points that are reachable from the internet. Some of the most important are these:

• Remote access gateways. These let staff work from home as if they were at their desk. A Citrix portal, like the one in this case, is one example. A VPN, or virtual private network, is another: it creates a private, encrypted tunnel from an employee’s laptop into the company network.
• Vendor support portals. Outside firms that maintain software or equipment often need a way in to fix things. Those back doors are easy to forget because a third party uses them.
• File transfer services. Systems that exchange large files with partners, such as claims or payment files, are often reachable from the internet by design.
• Email and cloud applications. Web-based mail and business apps are doors too, each with its own login page.

Behind each door lies a question of identity: whether the person typing is genuinely the employee they claim to be. A password alone is weak proof. Passwords are reused across sites, guessed, stolen by fake login pages and sold in bulk by criminals. That is why MFA exists. It asks for a second kind of proof, usually something you have, such as a phone, on top of something you know.

MFA is not perfect, and determined attackers have ways to trick people into approving a login. But it raises the cost of attack sharply, which is why it has become a baseline expectation for any door that opens onto the internet. When one door lacks it, the strength of every other door matters much less. Attackers do not need to break in everywhere. They need one entrance.

Why remote-access doors draw the most traffic

Remote-access gateways are attractive to criminals for three reasons. They lead straight to a desktop inside the network, with the same reach as an employee at their desk. They are built to be reachable from anywhere, so the attacker does not need to get past anything first. And the credentials that open them are widely traded. Malware that steals saved passwords from home computers, often called infostealers, feeds a market in working logins for corporate portals. A gateway that accepts a password alone turns one infected family laptop into a way into the company.

The appliances themselves also carry risk. Remote-access products from several vendors, Citrix among them, had serious software flaws exploited by ransomware groups in 2023. The Change Healthcare testimony did not blame a software flaw; it described stolen credentials and a missing second factor. The two risks call for the same discipline, though: knowing every gateway the organization runs, who patches it and how it checks identity.

Not all MFA is equal either. Codes sent by text message and simple push approvals can be defeated by attackers who trick or tire out a user. Federal guidance from CISA, the national cybersecurity agency, has for several years pointed organizations toward phishing-resistant methods, such as hardware security keys, for the most exposed accounts. For an acquirer, the first goal is coverage: every door asks for a second factor. Strength comes next, once the doors are known.

Once inside, ransomware gangs typically spend time exploring, finding valuable data and systems, taking copies and then triggering the encryption that freezes everything. At Change, that interval was nine days. By then, the question of how they got in can feel academic. The Change Healthcare testimony is a reminder that it is not. The first door decides a great deal of what follows.

Before closing: diligence that counts doors

Security due diligence in health care deals usually takes the form of a questionnaire, a review of written policies, interviews with the target’s technology leaders and perhaps a summary of past incidents. Those methods are useful, but they mostly report intent. A target with an MFA policy will answer yes to an MFA question, honestly, while a legacy gateway or vendor support portal is left outside it. Nobody is lying. The policy simply does not describe every door in the building.

Certifications have the same limit. UnitedHealth told senators that it held HITRUST certifications, a widely used health care security assessment, across many applications, including certain Change Healthcare systems. A certification describes the systems inside its scope on the day of the assessment. It says little about a forgotten portal outside that scope. Buyers should read the scope statement before they read the score.

A sharper method is to count the doors. Before signing, or at the latest before closing, the buyer can map the target’s internet-facing footprint from the outside, much as an attacker would. That covers domains (the web addresses the company owns), IP ranges (the numerical addresses of its machines on the internet), remote desktop and VPN gateways, file transfer services and vendor support portals. Specialist firms and tools can do much of this without touching the target’s internal systems, because they look only at what anyone on the internet can already see.

For each exposed login, the buyer asks two questions: how does it authenticate, and who owns it? The output is a list, not a maturity score. A score of “3.2 out of 5” tells an executive very little. A line that reads “remote desktop portal, password only, owned by the IT operations team, used by about four hundred staff” tells them exactly what to worry about. The list should also record which logins depend on third parties, such as managed service providers (outside firms that run parts of a company’s technology), because those contracts will need changing after closing.

A second outside-in check is worth adding where the target permits it: searching criminal markets and breach data for the target’s own credentials. Several threat intelligence firms sell this as a service. A finding that employee passwords for the target’s domain are circulating does not prove a breach. It does tell the buyer which doors an attacker is most likely to try first.

That list has deal value. It can feed specific representations in the purchase agreement, meaning formal statements by the seller that particular facts are true. It can support a remediation covenant before closing, a promise by the seller to fix named issues before the deal completes. Where the exposure is large, it can justify a price or escrow adjustment, with money held back to cover the cost of remediation. Counsel will shape what is practical, and some targets will resist outside scanning before signing. But a buyer that never sees the list cannot negotiate over it.

What a buyer may and may not do before closing

There is a legal limit on how far a buyer can go before the deal completes. US antitrust law requires large deals to wait out a federal review period, and a buyer that starts running the target’s business early can be accused of “gun-jumping.” Taking over the target’s security operations, pushing the buyer’s own staff into its systems or directing its spending can all raise that concern. Competitors buying each other also need “clean team” rules for sharing sensitive information during diligence.

The practical consequence is that pre-closing fixes are made by the seller, under covenants the buyer negotiates. The buyer names the gap, the seller closes it, and evidence of the fix becomes a closing deliverable: a fresh external scan, a configuration export, a signed confirmation. The buyer can also prepare everything it will do on day one, so nothing waits for planning once control passes. Antitrust counsel should review the plan, because the line between preparing and controlling is a legal judgment.

Health care deals often have long gaps between signing and closing. Beyond federal antitrust review, a growing number of states require notice or review of health care transactions; Oregon, for example, created a review program for them in 2022. A gap of several months is frustrating for the deal team. For security, it is an opportunity: time for the seller to close named doors, and for the buyer to confirm each fix from the outside before the keys change hands.

How deal documents price a known gap

Many buyers now insure their deals with representations and warranties insurance, which pays if the seller’s statements turn out to be false. These policies typically exclude problems the buyer knew about before signing. A missing second factor found in diligence is therefore usually not insurable through that policy. The buyer has three options: have the seller fix it before closing, negotiate a specific indemnity or escrow for that issue, or accept the risk and fix it quickly after closing. Each choice should be written down, with the reason.

Carve-outs add a further complication. When a buyer acquires a division of a larger company, the seller often keeps running its technology for months under a transition services agreement. During that period, the doors belong to the seller’s network while the business belongs to the buyer. The agreement should say who enforces MFA on which gateways, who watches the logs and who must report an incident to whom, and how fast. Without those terms, a carve-out can spend its first year in a window with two landlords and no single owner.

Two doors the questionnaire missed

Suppose a regional health system is buying a billing services company. The questionnaire comes back clean: MFA is required for all remote access. The outside-in map tells a fuller story. It finds the main VPN, which does enforce MFA, plus an older remote desktop portal still used by the overnight team and a support portal for a software vendor, both protected by passwords alone. Neither appears in the policy documents because both predate them. The buyer’s counsel negotiates a covenant that both will be closed or protected before closing, and the integration team now knows exactly which two doors to check on day one. The cost of finding them was a few weeks of work. The cost of missing them could have been far higher.

Scale changes the method, not the question

The method has to fit the deal. A national insurer buying a technology company with decades of layered systems needs a full external map, a review of identity platforms and a staged integration plan. UnitedHealth itself described Change as a forty-year-old company whose networks and systems had been built on top of one another. A physician group buying a ten-doctor practice may face only three or four doors, often run by a small managed service provider. There, the useful diligence is a call with that provider and a screenshot of its MFA settings. Private equity roll-ups buy dozens of small practices in quick succession, and they face the opposite problem. Each deal is small, but together they add many doors at a pace no central team reviews one by one. A standard pre-closing check, applied to every deal regardless of size, is the realistic answer there.

The interim: a short list with dates

Full integration of a large acquired company takes years. Identity platforms (the systems that manage who can log in to what), networks, monitoring and applications move on a schedule driven by cost and business disruption. Nobody wants to break a profitable business in the rush to standardize it. During that period the acquired entity runs on its own controls while the parent’s policies apply in name. This is the gap the Change Healthcare testimony described: a unit still being brought up to the parent’s standards.

Large acquirers know this, and many have a baseline program for new acquisitions. UnitedHealth told senators that it had one, called Security Shield: a set of high-priority controls and practices deployed to newly acquired companies. The existence of such a program is not the test. What matters is how quickly its controls reach every door, and whether anyone verifies that they have.

The answer is to separate a small interim control set from the long migration. Four controls fit on one page:

1. MFA on every remote-access path, enforced at the gateway even if identity is not yet merged. The acquired company does not need to be on the parent’s login system for its own gateway to demand a second factor.
2. A review of privileged and service accounts, with stale ones disabled. Privileged accounts are the master keys, the logins that can change settings or reach everything. Service accounts are logins used by software rather than people. Both tend to pile up unnoticed over the years.
3. Logs from the acquired environment feeding the parent’s security operations center, so someone is watching. Logs are the automatic records systems keep of who did what and when. A security operations center is the team, in-house or outsourced, that watches those records for signs of trouble.
4. Tested offline backups for systems whose loss would stop revenue. Offline means stored where ransomware cannot reach and scramble them. Tested means someone has actually restored from them recently.

Each control needs one named owner and a date measured in weeks from closing, not quarters. None requires the acquired company to change its applications, which is why they can move quickly.

A sequence for the first ninety days

Order matters as much as content. On the day of closing, the buyer can reset passwords for the most powerful accounts and revoke access for anyone who left in the deal. It can run its own external scan to confirm the pre-closing fixes held. It can also install its detection software, often called endpoint detection and response, on the acquired company’s servers and laptops. That gives the security operations center eyes inside the new environment before anything else changes.

Within the first thirty days, MFA should be enforced on every remote-access path on the map, and logs from those gateways should be arriving centrally. Within ninety days, backups for revenue-critical systems should have been restored in a test. The acquired company’s incident response plan should also be joined to the parent’s, with one phone tree and one decision on who calls the FBI and the regulators. Dates like these are illustrative, and each organization will set its own. Writing them down is what makes slippage visible.

Connecting the networks is a second decision

Integration teams often want to connect the acquired network to the parent’s quickly, so shared services and email can move. That connection is itself a risk decision. A network that is joined before its doors are locked gives an intruder in the acquired company a path into the parent. The Change case shows the other side of the trade-off. UnitedHealth said the attack did not spread beyond Change, and cutting connectivity to Change’s data centers helped contain it. Separation slowed integration, and it also limited the damage.

A sensible rule is to connect only through narrow, monitored paths until the interim controls are verified. Trust between the two companies’ directory systems, which decide who can log in where, should be limited and one-way where possible. Full network integration waits for evidence, not for the project calendar.

The trade-off is friction. Enforcing MFA on a legacy gateway can break workflows, and vendor support access is often the first casualty. A software supplier that used to log in with a shared password may suddenly be locked out in the middle of the night. Integration leaders should budget for those exceptions explicitly, with compensating controls such as restricted source addresses (only allowing connections from the vendor’s known locations) and time-limited access (opening the door for a specific job, then closing it again), rather than letting them persist by default.

The interim also needs a decision rule for anything that cannot meet the deadline. A portal that cannot support MFA in thirty days should be taken offline, put behind the parent’s gateway or formally accepted as a risk by a named executive. Silent carry-forward is the failure mode the testimony described. A risk someone has signed for has an owner and a review date. A risk nobody has noticed has neither.

Afterward: proof for boards and customers

The last stage is evidence. Members of Congress asked, in effect, whether leadership knew. That is the question every board should expect after an incident, from regulators, customers, journalists and shareholders. Most boards receive security reporting as framework scores and project lists: a percentage of compliance against a recognized standard, a set of initiatives in green, amber and red. Few see a direct list of known exceptions to critical controls, by entity.

A useful board report for an acquiring organization is short. It names the critical controls, the entities where each is not yet enforced, the owner and the closing date. Acquired entities appear as separate lines until fully integrated, rather than disappearing into a group average. Coverage figures come from external testing of every exposed login, reconciled against the identity platform’s enforcement reports. The identity dashboard alone cannot see portals that authenticate somewhere else, which is exactly where the acquired company’s old doors tend to live.

The evidence file an examiner or auditor will ask for

After an incident, a buyer will be asked to show its work. Regulators, plaintiffs’ lawyers and insurers tend to request the same documents. They include the pre-closing external map and the findings it produced. They include the deal terms that addressed those findings, the interim control list with owners and dates, and the evidence that each control was in place. They also include the risk acceptances for anything that missed its date, signed and dated. A buyer that kept these records can show a reasonable program that met a determined attacker. A buyer that kept only a policy will struggle to show anything.

Metrics that show the window closing. A few numbers tell a board whether the window is shrinking. The first is the share of internet-facing logins at each acquired entity that external testing confirms require a second factor. The second is the count of open exceptions, with the age of the oldest. The third is the number of privileged accounts in the acquired environment, which should fall sharply after the first review. The fourth is the date of the last successful restore test for each revenue-critical system. Each number comes from a source the board can ask to see, and none can be met by writing a policy.

The evidence also has to be current. A scan from the week of closing proves little about a portal stood up a year later by a business unit in a hurry. External scanning of all acquired entities should run continuously, with new findings routed to the same exception list the board sees.

Different owners, different audiences

Who needs the proof depends on the type of organization. A public company like UnitedHealth answers to investors under the SEC’s cybersecurity disclosure rules, which took effect in late 2023. Those rules require prompt disclosure of material incidents and an annual description of how the board oversees cyber risk. UnitedHealth disclosed the attack in an SEC filing the day after the ransomware was deployed. A nonprofit health system answers to its board, its bondholders and its state regulators. A business associate answers to the covered entities whose data it holds, under the contracts HIPAA requires. Each audience wants the same underlying facts, framed differently.

Customers need a version of the same proof. Thousands of providers relied on Change Healthcare. It was a health care clearinghouse, which HIPAA treats as a covered entity in its own right. It also served many providers as a business associate, the HIPAA term for a vendor that handles protected health information on a provider’s behalf. Their security questionnaires asked whether the vendor required MFA for remote access, and a policy-level yes would have satisfied them. For critical vendors, health systems can instead ask sharper questions: how is coverage verified, how often, by whom, and has the vendor made acquisitions whose environments are not yet integrated? Contract language can require notice of material acquisitions and a timeline for bringing acquired systems that touch the customer’s data under the vendor’s controls.

This turns the acquisition window from a private integration matter into a disclosed, dated risk. A board that sees the list can ask why a date slipped. A customer that knows about the acquisition can ask which systems hold its data. Organizations should take counsel’s advice on how such terms interact with business associate agreements and deal confidentiality.

What the open door cost

The missing MFA check cost money, drew lawmakers to the issue and shook customers’ faith in the sector’s security questionnaires.

Money. The company paid a $22 million ransom, and that was only one line in the cost of the event. Rebuilding Change’s environment meant replacing thousands of devices and standing up a new data center network in weeks. Advancing more than $6.5 billion to providers by late April protected the company’s customers, but it tied up cash and created loans to be tracked and recovered. Providers that depended on Change Healthcare faced their own cash crises. When a business is at the center of a network, its failure is everyone’s problem.

Concentration. Change’s reach was the reason a single door mattered so much. The testimony put Change’s share of US health care payments at about six percent, and lawmakers’ written questions described a company touching a very large share of patient records. Many providers had connected to Change and to nothing else. When it went dark, some switched clearinghouses in a hurry, at their own expense. UnitedHealth told senators it was now encouraging clients to keep at least two alternative channels. That advice applies to every critical vendor, and it comes with a cost: a second connection must be built, tested and paid for in years when nothing goes wrong.

Regulators and lawmakers. A chief executive testifying before two committees of Congress is a cost in itself: time, legal preparation and lasting attention. Senators from both parties asked the same pointed question, which is a sign of how quickly a technical detail becomes a matter of public accountability. The health department’s civil rights office, which enforces HIPAA, had opened an investigation within weeks of the attack.

Customers and reputation. Customers trusted a policy-level yes. Once it became clear that a door had been left open, every vendor questionnaire in the sector started to look less reassuring. Trust lost that way is slow to rebuild.

Strategy. Acquisitions are usually justified by scale, efficiency and reach. If each deal also brings a period of hidden exposure, that exposure belongs in the deal model alongside integration costs and expected savings. Buyers that price it in, and manage it on a dated plan, are making a better investment.

Earlier deals that carried old doors

Change was not the first case of a buyer inheriting someone else’s intrusion or weakness. Marriott bought Starwood in 2016. Attackers had been inside Starwood’s guest reservation system since 2014, and the intrusion was not discovered until 2018. The United Kingdom’s data protection regulator later fined Marriott £18.4 million over the breach. When Verizon bought Yahoo’s internet business in 2017, the price was cut by $350 million after Yahoo disclosed massive data breaches. In both cases the problem existed before closing. Diligence that looked from the outside, and integration that moved quickly on the basics, were the tools that could have shortened the exposure.

Lists, dates and named owners

Organizations that handle this well share a few habits. They treat security findings in diligence as negotiable deal terms, not as background reading. They publish a short interim control list on the first day after closing, with names and dates. They measure coverage from the outside, the way an attacker would, rather than trusting the dashboards of systems that may not see every door. And they report exceptions to the board by entity, so an acquired company never hides inside a group-wide average.

The failures are just as recognizable:

• Trusting the questionnaire. A yes to “Do you require MFA?” describes a policy. It does not prove every door enforces it.
• Waiting for full integration. Treating security as something that will be fixed when the acquired company moves onto the parent’s platforms, which may be years away.
• Letting exceptions drift. Allowing a vendor portal or legacy gateway to keep working “temporarily” without a named owner, a deadline or a signed risk acceptance.
• Reporting averages. Showing the board a group-wide compliance score that blends a well-run parent with a newly acquired unit, hiding the weakest link.
• Forgetting third parties. Overlooking the logins that outside service providers use, because no employee owns them.

These failures require no bad faith. They arise naturally when a busy organization is absorbing a large business and trying not to disrupt it. That is precisely why they need a deliberate counterweight.

The case against blaming the deal

There is a fair objection to this argument. Plenty of organizations that never made an acquisition have been breached through a single weak login. MFA can be bypassed, and attackers increasingly steal the session tokens that let a logged-in user skip the second check. On this view, the acquisition was incidental, and the lesson is about MFA everywhere, not about deals.

A second objection is about speed. Integrating too fast carries risks of its own: outages, broken clinical and billing workflows, and staff who leave because their tools changed overnight. A buyer that forces every acquired system onto its own platforms in the first month may cause more harm than it prevents.

A third objection comes from smaller buyers. A rural hospital buying a clinic, or a credit union buying a small insurance agency, may have no budget for threat intelligence or specialist scanning. The objection is fair, and the method scales down. CISA offers free external vulnerability scanning to critical infrastructure organizations, health care providers among them. The single most useful step costs nothing: asking the target’s IT provider to demonstrate a login to each remote-access door, live, during diligence.

All three objections have force, and none defeats the argument. The first is right that MFA is not sufficient on its own. But the acquisition window explains why a basic control was missing at a company whose parent required it. Such a lapse is a different and more predictable failure than a sophisticated bypass. The second objection is right about full integration, which is why the interim list is deliberately small. Enforcing a second factor at a gateway, reviewing powerful accounts, collecting logs and testing backups do not require moving applications. They are the controls that can run ahead of integration, and the ones attackers test first.

What an acquirer should know about its doors

For a chief executive, board member or general counsel, the most useful contribution is often a set of plain questions asked at the right moment. These are worth raising before the next deal and at the next risk committee meeting:

• For each company we have acquired in the past few years, is every internet-facing login protected by MFA today, and how do we know, beyond a policy document?
• Which logins are used by outside vendors or managed service providers, and who on our side owns each one?
• Which systems in acquired businesses have missed those deadlines, and who has formally accepted the risk?
• In our next deal, will we see an outside-in map of the target’s doors before we sign, and how will our counsel use it in the agreement?
• Does our board report show acquired entities as separate lines until they are fully integrated?

The same window outside health care

The questions travel across sectors, with different rules attached. A bank that buys a fintech, or acquires another bank, brings the target’s systems under examination by its federal regulators, who expect third-party and integration risks to be managed. Bank regulators’ 2021 incident notification rule also requires banks to tell their primary regulator within 36 hours of a significant computer-security incident. That clock does not pause because the affected systems came with a recent deal. A broker-dealer acquiring an advisory firm takes on that firm’s client data obligations under SEC rules.

In government, the equivalent is consolidation rather than purchase. A state that merges agencies, or a county that takes over a regional service, inherits doors in the same way. Federal agencies that absorb a program or a shared service must bring its systems under their own authorizations to operate, the formal approvals federal systems need under FISMA, the federal information security law. Mergers of public bodies rarely come with a purchase agreement. The interim list and the board-level exception report work just as well without one.

If the answers come back as scores and reassurances rather than lists and dates, that is itself useful information. The Change Healthcare testimony showed how much can rest on a single door. The work of finding those doors is unglamorous, but it is the kind of work a leader can insist on and verify.

With hindsight

The scale of the breach kept growing long after the hearings ended. In January 2025 UnitedHealth estimated that about 190 million people had been affected. In July 2025 it revised the figure to about 192.7 million, making it the largest health data breach reported to HHS, the federal Department of Health and Human Services. Those numbers put the original question in sharper relief: a single login page without a second check stood upstream of the personal health information of a very large share of the country.

The financial picture grew as well. UnitedHealth’s own quarterly reports through 2024 put the costs of the attack, including the response and the disruption to its business, in the billions of dollars. Those costs did not include what providers spent switching clearinghouses, borrowing to cover payroll or catching up on unbilled claims. The ransom also bought less than it seemed to. Reporting at the time indicated that the group that collected the $22 million disappeared without paying the affiliate that carried out the attack. Stolen data was then used for a second extortion attempt in April 2024. Paying did not end the exposure.

The notice burden reshaped how breaches are handled across the sector. Thousands of providers were potentially obliged to notify their own patients about data held by a single clearinghouse. HHS’s civil rights office allowed the arrangement Change Healthcare offered: Change would make the notifications, including to individuals, regulators and the media, on behalf of covered entities that chose that route. It reduced duplicated letters and confusion. It also showed how much of a provider’s compliance position can depend on a vendor’s ability to analyze its own stolen files. UnitedHealth told senators that it had to obtain a safe copy of the data from the FBI before it could even begin that analysis.

Regulators moved too. In late December 2024 HHS proposed an overhaul of the HIPAA Security Rule, the federal rule that sets the security standards for organizations handling electronic health information, and the proposal was published in January 2025. It would make MFA a requirement, with limited exceptions, rather than one option among several. It would also add a requirement for an asset inventory and a network map, which is close to a formal version of the door-counting described in this article: a written record of what systems exist and how they connect.

Two details of that proposal bear directly on acquisitions. It listed a sale, transfer, merger or consolidation among the changes that would require an organization to update its inventory and network map. And it would require covered entities to obtain written verification, at least once a year, that their business associates had deployed the required technical safeguards. A business associate would also have to tell its customers within 24 hours of activating its contingency plan. Hospital groups objected that the proposal as a whole would be costly to implement. By mid-2026 the final rule had not been issued, so organizations should track its status with counsel rather than assume either outcome.

Inside UnitedHealth, the changes it described to senators were the ones this article would expect. It said it was accelerating the work to bring Change’s systems up to its standards. It also brought in Mandiant, the incident response firm, as a standing advisor to the board committee that oversees cybersecurity. Those steps address the window after the fact. The harder discipline is to close it before anything goes wrong.

The acquisition angle aged well. Health care consolidation continued, and the gap between closing a deal and securing the acquired estate remained a common route for attackers in sectors well beyond health care. Banks buying fintechs, agencies absorbing shared-service providers and insurers acquiring brokers all face the same window. The missing-MFA theme also kept recurring outside deals. In mid-2024 a campaign against customer accounts on the Snowflake data platform succeeded largely because stolen passwords worked on accounts with no second factor.

What lasts is less about MFA itself, which is now a baseline expectation, than about how organizations know what they think they know. The practices that held up are the ones that produce lists rather than scores: outside-in mapping before closing, a dated interim control set in the first weeks, and board and customer reporting that names exceptions by entity. Each of them turns an assumption into something a person can check. When the next deal closes, the most valuable document on the first day may be the shortest one: a page that names every open door, who owns it and when it will be shut.