According to UnitedHealth CEO Andrew Witty’s congressional testimony, reported by BleepingComputer, criminals used compromised employee credentials on 12 February 2024 to reach a Change Healthcare Citrix portal used for remote desktop access. The portal did not have multi-factor authentication. Phishing-proof, device-bound MFA 2.0 on that workforce door would have blocked password-only sign-in and closed initial access. Lateral movement, exfiltration, and ransomware after a live session already exists are residual post-authentication problems no login MFA undoes.
For the full attack chain and timeline, read the companion on legacymfa.sucks.
FAQ
Would MFA have prevented Change Healthcare Citrix initial access?
Yes for the portal login. The Change Healthcare Citrix remote-access path accepted a compromised employee password alone on 12 February 2024 because multi-factor authentication was not enabled, per Witty’s testimony via BleepingComputer. Any real second factor at that door would have stopped sign-in with the stolen password alone. That prevention claim applies only to initial access, not to everything that followed inside the network.
What does phishing-proof MFA 2.0 change on a Citrix-style portal?
Phishing-proof MFA 2.0 replaces transferable passwords and one-time codes with device-bound public-key credentials. There is no reusable password secret for an attacker to present at the portal, and the private key never leaves the enrolled device. Closing the phishable login stops this path. Prevention, not detection is the architectural point: the password-only Citrix door never opens. Public reporting does not establish whether the Change Healthcare password was stolen by phishing or by information-stealing malware; either way, a passwordless device-bound gate removes the single factor the attackers used.
Would MFA 2.0 have stopped lateral movement, data theft, or ransomware?
No. After the Change Healthcare Citrix session existed, the threat actor moved laterally, exfiltrated data over roughly nine to ten days, and deployed ransomware around 21 February 2024. Login MFA does not constrain an already-established internal session, stop bulk theft from the internal side of the portal, or prevent encryption days later. Those phases need segmentation, monitoring, and containment. MFA’s honest prevention value ends at the remote-access door.
Was this an MFA bypass or a missing control?
It was a missing control. Witty’s testimony states the Change Healthcare Citrix portal did not have multi-factor authentication, not that a second factor was challenged and defeated in real time. Public reporting does not describe push fatigue, adversary-in-the-middle relay, or device-code abuse on that first sign-in. A password-only remote-access login is a single-factor door, not a bypassed second factor.
What should CISOs require on workforce remote-access portals after Change Healthcare?
Require phishing-proof device-bound authentication on every Citrix, VPN, and remote-desktop workforce path, not optional legacy OTP added later. Password-only remote access is a single reusable secret into the desktop estate. Why legacy MFA was dropped still matters when recovery and enrollment can reintroduce transferable secrets. Pair strong portal authentication with session revoke hygiene and endpoint controls for the harder residual case: malware after a legitimate login. Fooling a password-only Citrix page is easy. Planting malware is not.
