Change Healthcare and ransomware: lessons for SMEs far from healthcare

The February 2024 ransomware attack on Change Healthcare — a central clearinghouse for US medical claims — caused weeks of outage, manual workarounds, and an enormous recovery cost. Most ADSA Labs clients are not in healthcare, but they depend on single vendors for payments, logistics, or identity the same way hospitals depended on one connector.

Single points of failure hide in plain sight: one payment gateway, one shipping API, one Supabase project with no backup test. We document critical third parties in client discovery and ask what happens if their SaaS is down for 72 hours.

Backups are not real until restored. For PostgreSQL and Supabase we schedule backups plus an occasional restore drill to a scratch instance. Finance modules and invoice PDFs get the same treatment — losing billing history is a business-ending event for an SME.

Incident response can be one page: who to call, how to rotate keys, how to tell customers. You do not need a war room to avoid panic when credentials leak or a supplier posts a breach notice.