Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
ALPHV/BlackCat appeared to go dark in early March 2024 after a person claiming to be the affiliate behind the Change Healthcare attack accused the ransomware group of keeping the ransom rather than paying the affiliate’s share. That allegation was not independently established. Change Healthcare later confirmed it paid a ransom, and UnitedHealth Group CEO Andrew Witty told a Senate committee on May 1, 2024, that the payment was $22 million.
What happened to BlackCat?
ALPHV/BlackCat was a ransomware-as-a-service operation: its developers maintained the ransomware and infrastructure, while affiliates carried out attacks and shared proceeds with the operators. The FBI, CISA and HHS described the group’s double-extortion approach, in which attackers steal data as well as disrupt or encrypt systems. The Justice Department’s December 2023 account describes the operation and the law-enforcement disruption of its infrastructure.
After the February 2024 attack on Change Healthcare, a 350-bitcoin transaction—worth roughly $22 million at the time—was reported on March 1 to a wallet researchers associated with ALPHV. In the following days, someone identifying themself as the affiliate publicly complained that the operators had taken the ransom and withheld the affiliate’s agreed share. The group’s sites then displayed a notice claiming an FBI seizure. Researchers questioned the notice’s authenticity and suspected an exit scam: a staged shutdown that could let operators disappear with funds or avoid accountability. Ars Technica reported that the UK National Crime Agency denied involvement and that the notice appeared copied from an earlier seizure notice.
Recommended Free Tools
This March episode is distinct from the documented law-enforcement action in December 2023. The DOJ said its earlier operation disrupted ALPHV infrastructure and gave more than 500 victims the capability to restore systems, saving approximately $68 million in ransom demands, according to its account at the time. That figure is not a current total. The disputed March notice does not establish that the FBI seized the group then.
#1 Best Overall
Did Change Healthcare pay, and how much?
Yes. Change Healthcare later confirmed to WIRED and other outlets that it paid a ransom, saying: “A ransom was paid as part of the company’s commitment to do all it could to protect patient data from disclosure.” On May 1, 2024, UnitedHealth Group CEO Andrew Witty confirmed to a Senate committee that the payment was $22 million. Earlier reporting connected a March 1 transfer of 350 bitcoin, then worth about $22 million, to an ALPHV-associated wallet; that wallet link was based on researchers’ attribution and contemporaneous reporting. WIRED’s report covers the company’s confirmation and the later Senate testimony.
Was the affiliate actually cheated?
The public accusation came from a self-described affiliate, not an independent investigation or adjudication of the payment dispute. In a ransomware-as-a-service arrangement, affiliates typically conduct intrusions and operators take a share of ransom proceeds. The affiliate’s claim that ALPHV kept the full payment—and the claim that the affiliate retained stolen data—should therefore be treated as allegations, not established facts. KrebsOnSecurity’s contemporaneous account reported the dispute and the group’s apparent collapse.
Did the payment stop the data leak?
No public confirmation that money changed hands can prove that stolen data was deleted or that every affected system was restored. WIRED later reported warnings that screenshots containing protected health information or personally identifiable information had been exposed, as well as a separate group’s claim to possess data. Those reports do not, by themselves, establish the full scope of any disclosure or who retained the data.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why the attack mattered beyond the ransom
Change Healthcare processes claims and payments across the healthcare system, so taking its systems offline disrupted transactions for providers and patients. In a March 9, 2024 response, the Centers for Medicare & Medicaid Services described directing Medicare Administrative Contractors to expedite provider moves to other clearinghouses and accept paper claims where needed. CMS also said it was considering accelerated payments for affected Medicare Part A providers and advance payments for Part B suppliers. These were measures described at that time, not a statement of current payment policy. CMS’s statement outlines the response.
Rank #3
What organizations can take from the incident
The FBI, CISA and HHS advisory on ALPHV recommends practical controls that reduce exposure and improve response readiness. It also recorded nearly 70 victims on ALPHV’s leak site, with healthcare the most commonly victimized sector since mid-December 2023; that is a dated snapshot based on observations through February 2024, not a current rate. The joint advisory recommends:
- Inventorying organizational assets and data so teams know what needs protection and recovery.
- Prioritizing known exploited vulnerabilities for patching.
- Enabling and enforcing multifactor authentication (MFA) with strong passwords. A hardware security key is one possible way to support MFA; the advisory does not endorse a particular product.
- Closing unused network ports and removing applications that are not needed for daily operations.
These are defenses, not guarantees. The DOJ’s December 2023 disruption also illustrates why recovery planning matters: law enforcement made a decryption tool available to affected victims, but organizations still need inventories, incident-response plans and tested recovery processes.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
