The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The U.S. State Department announced an offer of up to $10 million for information leading to the identification or location of key ALPHV/Blackcat ransomware leaders. A separate offer provides up to $5 million for information leading to the arrest or conviction of people involved in the group. The offers concern ALPHV/Blackcat and its activities broadly—not only the Change Healthcare breach.
The State Department notice is dated February 15, 2024, and its page is archived and says it is not updated. It establishes the offer’s historical terms, but does not confirm whether it is currently available.
What is the $10 million reward for?
The State Department’s February 15, 2024, notice offers up to $10 million for information leading to the identification or location of key leaders of ALPHV/Blackcat, a ransomware-as-a-service operation. It lists a separate reward of up to $5 million for information leading to the arrest and/or conviction of people who conspire to participate in, or attempt to participate in, ALPHV/Blackcat activity. Read the official notice; the page is archived and explicitly says it is not updated.
| Reward threshold | Maximum | What qualifying information concerns |
|---|---|---|
| Identify or locate leaders | Up to $10 million | Key ALPHV/Blackcat leaders |
| Arrest and/or conviction | Up to $5 million | People conspiring to participate in, or attempting to participate in, ALPHV/Blackcat activity |
These are maximum offers, not guaranteed payments. The notice does not set out a formula for determining an award.
#1 Best Overall
Is the reward specifically for the Change Healthcare hackers?
No. The offer is directed at ALPHV/Blackcat leaders and participants, not exclusively at people responsible for one victim’s breach. Change Healthcare is a prominent incident associated with Blackcat, but the reward notice describes the group and its activity more broadly. The Department of Justice’s Blackcat release likewise describes information about Blackcat, its affiliates, or its activities as potentially relevant to a State Department reward.
Do not confuse this offer with a separate State Department offer of up to $10 million announced by DOJ for information leading to the location or identification of North Korean hacker Rim Jong Hyok. That case is unrelated to the ALPHV/Blackcat reward and Change Healthcare offer. See the DOJ announcement.
How can someone submit information?
The archived State Department notice directs people to submit tips through its Tor-based channel. It also directs people outside the United States to contact the nearest U.S. embassy or consulate and people in the United States to contact a local FBI office. The notice states: “ALL IDENTITIES ARE KEPT STRICTLY CONFIDENTIAL.” It says U.S. government officials and employees are not eligible for the reward.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Because the notice is archived and not updated, check with the relevant official channel before relying on these instructions or assuming the offer remains open.
Rank #3
What is ALPHV/Blackcat?
The Department of Justice describes Blackcat as ransomware-as-a-service. Its developers build and update the ransomware and maintain illicit infrastructure; affiliates use it to find and attack victims, with ransom proceeds shared between them. This division of labor means “the hackers” may refer to different people in the operation rather than one single intrusion crew.
DOJ says Blackcat affiliates may steal data before encrypting systems, then demand payment both to decrypt the systems and to prevent publication of the stolen information. The department describes this as a multiple-extortion model. Its estimate of worldwide losses in the hundreds of millions covers Blackcat activity broadly—including ransom payments, stolen or destroyed proprietary data, and response costs—and is not a Change Healthcare-specific loss estimate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What happened in the Change Healthcare breach?
HHS’s Office for Civil Rights says Change Healthcare filed an initial breach report on July 19, 2024, listing approximately 500 affected individuals while the company continued determining the total. HHS records that Change Healthcare’s July 31, 2025 update put the number of people impacted at approximately 192.7 million. That is the dated figure reported by HHS; it does not mean every affected person experienced identity theft or another particular form of harm. See the HHS Office for Civil Rights FAQ.
HHS says regulated entities retain responsibility for ensuring required breach notices are made, though a covered entity may delegate the task to a business associate. The FAQ addresses the notification responsibilities and related questions for entities covered by HIPAA.
Best Value
Reported effects on health services
In February 2024, the Associated Press reported that health systems were facing difficulties with insurance-coverage eligibility checks, pharmacy prescriptions, claims, and cash flow during the incident’s early period. These were reported effects, not evidence that every provider or patient experienced the same disruption. The AP also quoted Bea Grause, president of the Healthcare Association of New York State, saying, “The impact to hospitals is just now really starting to crystallize and as a result has been underreported.” Read the Associated Press report.
What is known about how the attackers got in?
The cited official material does not establish the precise initial access method used in the Change Healthcare intrusion. DOJ discusses compromised credentials among methods used in Blackcat attacks generally, but that general description is not proof of how this particular breach began.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
