how it happened
- whoattackersstolen credentials
- the gapCitrix portal, no MFAone exception
- thenpayment systemsUS claims processing stopped
- the result~192.7M peopleweeks of disruption
what everyone assumed
Every MFA rollout has exceptions, and each one is individually defensible: a legacy system, a migration in flight, a service that breaks with a second factor. The policy covers everything that matters, the exception list is short and getting shorter. One server on it hardly registers.
what happened
Compromised credentials met the one door with no second lock. From that single entry the intrusion widened into ransomware across systems that processed payments for a large share of US healthcare. The exception had been a line in a configuration; for weeks it became the national news.
step by step
- a remote access server without MFAOne door with no second lock.the assumption breaks here
- compromised credentials open itThe attacker enters as a normal user.
- ransomware spreads through payment systemsSystems handling a large share of US healthcare payments go down.
- about 192.7 million people affectedWeeks of disrupted care payments follow.
how it surfaced
Pharmacy and payment disruption made the incident public within days, and the accounting took longer: approximately 192.7 million individuals affected (HIPAA Journal, 2025), weeks of disrupted care payments, and a post-mortem that began at a remote access server without MFA.
MFA coverage is binary per door, and attackers inventory doors.
The policy’s average means nothing; the exception list is the attack surface.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersA stolen password gets someone through that exact portal.what it costs youFrom there they spread ransomware across systems your customers rely on, for weeks.
- or it goes like thisit happened23andMe, 2023howLeaked passwords are tried against customer accounts until some open.what leavespersonal details of customers and their contactswho ends up with itfraudsters
- or it goes like thisit happenedThe Snowflake wave, 2024howAn old password opens a data store that never required a second step.what leavesthe whole database in one downloadwho ends up with itan extortion group
sources
your turn
what you can do about it
this week
List every internet-reachable login that still has no second factor.
Your exception list exists, even if it lives in someone's memory rather than a document. Every entry on it is a bet that attackers will not find that particular door. The list of internet-reachable logins without a second factor is checkable this week, and this incident is what the unchecked version looked like at scale.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →