The business process was wider than the affected network
The Change Healthcare attack disrupted services beginning in February 2024. In written testimony for a May congressional hearing, UnitedHealth Group chief executive Andrew Witty described the use of compromised credentials to access a Citrix portal without MFA, lateral movement and later ransomware deployment. His account also described isolating the affected environment and rebuilding infrastructure.
The testimony is the company's account of its investigation and response. It should be read as such, rather than converted into an independently verified FISRO reconstruction. It nevertheless establishes a practical dependency problem: services outside the compromised network can be disrupted when their transaction path depends on it.
An organisation can have available computers, functioning internet access and no detected local malware while still being unable to complete a necessary business transaction. Security continuity planning needs to map that state explicitly.
Draw a transaction path, not just an infrastructure map
Choose an important workflow and trace the parties required to complete it. Identify where a transaction enters, which identity authorises it, which intermediary processes it and what confirmation the originating organisation needs before continuing.
For a payment or claims workflow, the useful question is not merely whether a supplier's portal is online. It is whether transactions can be submitted, processed, reconciled and confirmed. A partial restoration can leave different participants with different views of completion.
This analysis can be performed with synthetic transactions and system documentation. It does not require collecting personal health information or reproducing a real customer's records. Keep the exercise focused on service dependencies, authority and reconciliation.
Plan for isolation as well as failure
Incident responders may intentionally disconnect a service to contain a threat. From a dependent organisation's perspective, that can resemble an outage, but the criteria for reconnection are different. A response plan should identify who can confirm that a route is safe to resume and what restrictions remain in place.
An alternate path also needs security review. Under pressure, teams can introduce manual exports, shared credentials or unfamiliar third-party services to restore a workflow. Record what data and authority the temporary route requires, who approved it and how it will be retired.
The useful continuity plan therefore has two tracks: restoring a minimum viable transaction process and maintaining control over the temporary arrangements used to do it. Recovery speed and evidence about those arrangements should be tracked together.
Reconciliation is part of restoration
When normal processing resumes, queued, repeated and manually handled transactions may need review. A system marked available does not establish that every outstanding item reached the correct state.
Define an owner for reconciling the backlog, a source of truth for transaction status and a way to identify duplicates or omissions. Those are service-design questions, not findings that a particular error occurred in the Change Healthcare response.
The distinction also improves incident communications. Report which functions have resumed and which reconciliation work remains. A single restored percentage can obscure the workflow that matters to a dependent organisation.
Put access exceptions inside the service review
An exercise with three transaction states
Use synthetic identifiers to represent three items: one accepted by the intermediary before isolation, one queued locally and one handled through an approved temporary route. No real patient, customer or financial record is required.
Ask the operational team to establish who owns the authoritative state for each item. The locally queued item may be straightforward to resubmit; the accepted item may require confirmation before another submission; the manually handled item may require reconciliation after the ordinary route returns. The exercise should discover those rules, rather than assume that resubmitting everything is harmless.
Then remove access to the usual status portal in the scenario. Which established contact can confirm processing state? Where is that contact recorded? What evidence can the originating organisation retain? A response plan that depends entirely on the unavailable portal has not yet described an independent continuity path.
Finally, restore the normal route and ask how temporary access, files and work queues are retired. Assign an owner to the reconciliation decision and a separate owner to closing temporary security exceptions. Both tasks can remain open after connectivity returns.
Report a useful service status
A status update should identify the function available, the population covered and the remaining limitation. “Submission restored; historical confirmations still being reconciled” is more operationally useful than an unexplained overall percentage. The wording must follow the actual evidence and avoid exposing sensitive records.
For suppliers, publish enough detail for dependent organisations to make their own continuity decisions. For customers, retain the supplier's dated statement alongside local transaction evidence. A later correction to the supplier's status can then be assessed without losing what informed an earlier decision.
The exercise's deliverable is a transaction-level recovery map with owners, evidence and retirement steps. It tests a concrete capability that an infrastructure availability check cannot establish.
Witty's account of an access route without MFA illustrates why reviews need to inspect effective control coverage, including acquired and legacy environments. A policy commitment is insufficient if the relevant portal or account follows an exception path.
The operational record should connect an exception to a service owner, the reason it exists, the authority it grants and the date for a new decision. That approach also applies to temporary recovery accounts created during an incident.
The earlier WannaCry response showed disruption through shared dependencies in the NHS. The CrowdStrike outage later tested recovery when many endpoints failed together. The causes differ; each is a reason to define restoration at the level of a working service and its transaction path, rather than only at the level of a running machine.