Back to Intelligence

Ambry Genetics $700K HIPAA Settlement: Detecting and Preventing Email Account Compromise in Healthcare

SA
Security Arsenal Team
September 19, 2026
11 min read

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced a $700,000 settlement with Aliso Viejo, California-based Ambry Genetics following a breach that exposed the protected health information (PHI) of more than 232,000 individuals. Ambry, a clinical genetic testing laboratory, becomes one of the clearest examples yet that OCR will levy significant civil monetary penalties even against organizations that self-report breaches — when the underlying security program failures are systemic.

The breach vector was depressingly familiar: an employee's email account was compromised, giving an unauthorized actor access to a mailbox containing large volumes of ePHI. The OCR investigation that followed didn't just examine the incident itself — it scrutinized Ambry's pre-breach security posture and found failures that HIPAA-regulated organizations everywhere should treat as a checklist of what NOT to have in your environment in 2026.

If you are a healthcare covered entity or business associate, this settlement is a warning shot. OCR's enforcement posture has hardened considerably in recent years, and email account compromise remains one of the top breach vectors in healthcare. This post breaks down what happened, what OCR found, and — most importantly — how to detect and prevent the same class of failure in your environment.

Technical Analysis: The Breach and the Compliance Failures

The Attack Chain

The Ambry Genetics breach followed a pattern we see constantly in healthcare DFIR engagements:

  1. Initial access via phishing/credential theft. An attacker gained access to an employee's email account. In the majority of healthcare email compromises we investigate, this originates with a credential phishing page — often a spoofed Microsoft 365 login portal — combined with the absence of phishing-resistant MFA.
  2. Mailbox access over an extended window. The attacker accessed the mailbox over multiple days. This dwell time is critical: it means the victim organization had days of opportunity to detect anomalous sign-ins, impossible travel, or unusual mailbox activity — and didn't.
  3. Massive data exposure. Because clinical staff routinely handle PHI in email (referrals, test results, insurance correspondence), a single compromised mailbox exposed records for over 232,000 individuals.

What OCR Found

OCR's settlement agreements are never just about the breach — they're about the security program. The investigation identified failures typical of HIPAA Security Rule enforcement actions:

  • Inadequate risk analysis (45 C.F.R. § 164.308(a)(1)(ii)(A)). Ambry had not conducted an accurate and thorough enterprise-wide security risk analysis covering all systems that create, receive, maintain, or transmit ePHI. This is the single most-cited deficiency in OCR settlements, and it consistently drives the largest penalties.
  • Insufficient monitoring of information system activity. The multi-day unauthorized mailbox access went undetected, indicating gaps in audit logging, alerting, and review of access to ePHI (§ 164.308(a)(1)(ii)(D), § 164.312(b)).
  • Failure to implement safeguards sufficient to reduce risks to a reasonable and appropriate level (§ 164.308(a)(1)(ii)(B)).

In addition to the $700,000 payment, Ambry agreed to a corrective action plan (CAP) requiring a comprehensive risk analysis, updated risk management plan, revised policies, and workforce training — with OCR oversight.

Why This Matters in 2026

Email account compromise remains the highest-frequency, highest-impact breach vector in healthcare. Since 2024, OCR has explicitly prioritized enforcement around risk analysis failures and has stated repeatedly that it will penalize organizations even when they are breach victims, if foundational Security Rule requirements were unmet. The current threat environment makes this worse: adversary-in-the-middle (AiTM) phishing kits that bypass legacy MFA, token theft attacks against session cookies, and OAuth consent phishing have all matured significantly in 2025–2026. If your healthcare organization's email security program looks the same as it did three years ago, you are the next settlement announcement.

Detection & Response

The core defensive lesson from the Ambry breach is detection latency. An attacker sat in a mailbox for days. The detections below target the observable behaviors of email account compromise in Microsoft 365 / Exchange environments, which dominate healthcare deployments.

Sigma Rules

The following rules target the highest-signal behaviors: suspicious inbox forwarding rules (data staging/exfiltration), impossible-travel sign-ins, and mailbox permission grants — the three most consistent post-compromise behaviors we observe in healthcare email intrusions.

YAML
---
title: Suspicious Inbox Forwarding Rule Created (Microsoft 365)
id: 8b2c4f16-3a71-4e9d-b5c2-7f1a9d3e6b08
status: experimental
description: Detects creation of inbox rules that forward or redirect email to external addresses, a common data exfiltration and persistence behavior following email account compromise in healthcare breaches.
references:
  - https://attack.mitre.org/techniques/T1114/002/
  - https://attack.mitre.org/techniques/T1020/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1114.002
logsource:
  product: office365
  service: exchange
detection:
  selection:
    Operation|contains:
      - 'New-InboxRule'
      - 'Set-InboxRule'
    Parameters|contains:
      - 'ForwardTo'
      - 'ForwardAsAttachmentTo'
      - 'RedirectTo'
  filter_internal:
    Parameters|contains:
      - '@yourdomain.com'
      - '@yourdomain.org'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate user-configured forwarding for approved workflows; maintain an allowlist of sanctioned external forwarding destinations
level: high
---
title: Impossible Travel Sign-In to Mailbox
title: Impossible Travel or Anomalous Sign-In to Exchange Mailbox
id: 3e7a9c21-5d48-4b6f-a1e3-9c2d8f4b7a15
status: experimental
description: Detects successful mailbox authentication from geographically improbable locations within a short window, indicative of credential compromise. Tune GeoIP velocity thresholds to your environment.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1110/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1078
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    AppDisplayName|contains:
      - 'Office 365 Exchange Online'
    Status: 'Success'
    LocationDetails.countryOrRegion|contains:
      - 'RU'
      - 'NG'
      - 'VN'
      - 'KP'
  condition: selection
falsepositives:
  - Traveling executives and VPN egress points; correlate with device compliance and prior user sign-in history before escalating
level: medium
---
title: Mailbox Full Access Permission Granted to External or Unusual Account
id: 6f1d8b34-2c59-4a7e-b3d6-1e9a5c7f2d43
status: experimental
description: Detects Add-MailboxPermission or Add-RecipientPermission operations granting access to a mailbox, frequently used by attackers to maintain access after initial compromise of a healthcare email account.
references:
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1098
logsource:
  product: office365
  service: exchange
detection:
  selection:
    Operation|contains:
      - 'Add-MailboxPermission'
      - 'Add-RecipientPermission'
  filter_admin:
    UserId|contains:
      - 'admin@yourdomain.com'
      - 'helpdesk@yourdomain.com'
  condition: selection and not filter_admin
falsepositives:
  - Delegated access for executive assistants and shared clinical mailboxes; baseline expected grantors and alert on deviations
level: high

KQL — Microsoft Sentinel / Defender Hunt Queries

These queries hunt for the post-compromise behaviors typical of healthcare email intrusions. The first surfaces anomalous sign-ins to Exchange Online with impossible-travel characteristics; the second hunts mass mailbox access events indicating bulk email collection (the behavior that turns a single account compromise into a 232,000-record breach).

KQL — Microsoft Sentinel / Defender
// Hunt 1: Anomalous Exchange Online sign-ins from new countries for the user
let lookback = 14d;
let baseline = SigninLogs
| where TimeGenerated > ago(lookback)
| where AppDisplayName has "Exchange Online"
| where ResultType == 0
| summarize KnownCountries = make_set(LocationDetails.countryOrRegion) by UserPrincipalName;
SigninLogs
| where TimeGenerated > ago(24h)
| where AppDisplayName has "Exchange Online"
| where ResultType == 0
| extend Country = tostring(LocationDetails.countryOrRegion)
| join kind=leftanti (baseline) on UserPrincipalName
| where isnotempty(Country)
| project TimeGenerated, UserPrincipalName, IPAddress, Country, Location, DeviceDetail, UserAgent
| sort by TimeGenerated desc;

// Hunt 2: Bulk mailbox item access (MailItemsAccessed) indicating mass email collection
OfficeActivity
| where TimeGenerated > ago(24h)
| where Operation == "MailItemsAccessed"
| where RecordType == "ExchangeItemAggregated"
| extend FolderCount = toint(parse_json(OfficeObjectId))
| summarize MailboxesAccessed = dcount(MailboxGuid), TotalOps = count() by UserId, ClientIPAddress, bin(TimeGenerated, 1h)
| where TotalOps > 50
| sort by TotalOps desc;

// Hunt 3: New inbox rules forwarding externally (complements Sigma rule 1)
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation in~ ("New-InboxRule", "Set-InboxRule")
| where Parameters has_any ("ForwardTo", "ForwardAsAttachmentTo", "RedirectTo")
| extend RuleParams = tostring(Parameters)
| where RuleParams !has "@yourdomain.com"
| project TimeGenerated, UserId, ClientIP, Operation, RuleParams;

Velociraptor VQL — Endpoint Hunt

When a mailbox compromise is confirmed, a critical scoping question is whether the attacker pivoted to the endpoint or stole local mail data. This artifact hunts for non-Outlook processes accessing Outlook data files (OST/PST), a strong indicator of local email theft, and for recently created HTML files in user download/temp directories that may be credential phishing lures.

VQL — Velociraptor
-- Hunt for non-Outlook processes accessing OST/PST files (local email theft)
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)\.ost|\.pst'
   AND Exe !~ '(?i)outlook\.exe|searchprotocolhost|searchfilterhost|msoffice'

-- Hunt for recently written HTML files in user download/temp paths (phishing lure artifacts)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  'C:/Users/*/Downloads/*.htm*',
  'C:/Users/*/AppData/Local/Temp/*.htm*'
])
WHERE Mtime > now() - 86400 * 7
   AND Size < 200000

Remediation and Verification Script

This PowerShell script audits the exact failure points in the Ambry incident across a Microsoft 365 tenant: external forwarding rules, mailbox permission anomalies, and legacy authentication status. Run with Exchange Online Management module and appropriate admin rights.

PowerShell
# Requires: ExchangeOnlineManagement module; Connect-ExchangeOnline first
# Ambry Genetics lesson: find forwarding rules, permission anomalies, legacy auth

Connect-ExchangeOnline

# 1. Audit all mailboxes for external forwarding/redirect rules
$mailboxes = Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox
foreach ($mbx in $mailboxes) {
    $rules = Get-InboxRule -Mailbox $mbx.UserPrincipalName -ErrorAction SilentlyContinue
    foreach ($rule in $rules) {
        if ($rule.ForwardTo -or $rule.ForwardAsAttachmentTo -or $rule.RedirectTo) {
            [PSCustomObject]@{
                Mailbox    = $mbx.UserPrincipalName
                RuleName   = $rule.Name
                ForwardTo  = ($rule.ForwardTo -join ';')
                RedirectTo = ($rule.RedirectTo -join ';')
            } | Export-Csv -Path .\ExternalForwardingRules.csv -Append -NoTypeInformation
        }
    }
}

# 2. Audit SMTP forwarding set at the mailbox level (bypasses inbox rules)
Get-Mailbox -ResultSize Unlimited |
    Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
    Select-Object UserPrincipalName, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward |
    Export-Csv -Path .\MailboxLevelForwarding.csv -NoTypeInformation

# 3. Find non-default FullAccess permissions on user mailboxes
$mailboxes | ForEach-Object {
    Get-MailboxPermission -Identity $_.UserPrincipalName |
        Where-Object { $_.AccessRights -contains 'FullAccess' -and $_.IsInherited -eq $false -and $_.User -notlike 'NT AUTHORITY*' }
} | Select-Object Identity, User, AccessRights | Export-Csv -Path .\FullAccessGrants.csv -NoTypeInformation

# 4. Verify legacy authentication is disabled (should return nothing in a hardened tenant)
Get-TransportConfig | Select-Object SmtpClientAuthenticationDisabled
Get-CasMailbox -ResultSize Unlimited | Where-Object { $_.PopEnabled -or $_.ImapEnabled } |
    Select-Object UserPrincipalName, PopEnabled, ImapEnabled

Remediation

There is no patch for a governance failure — the Ambry settlement requires program-level remediation. Based on the OCR findings and our IR experience with healthcare email compromise, prioritize the following:

Immediate (0–30 days)

  1. Enforce phishing-resistant MFA on all email access. FIDO2/passkeys or certificate-based authentication for privileged users at minimum. AiTM phishing kits now routinely bypass SMS and push-based MFA. If full FIDO2 rollout isn't feasible short-term, enforce Conditional Access policies requiring compliant devices and block legacy authentication protocols (IMAP, POP3, SMTP basic auth) entirely.
  2. Disable or tightly govern external email forwarding. Block automatic forwarding to external domains at the tenant level (Set-HostedOutboundSpamFilterPolicy -AutoForwardingMode Off) and alert on any exception via the detections above.
  3. Deploy impossible-travel and anomalous sign-in alerting. Whether via Microsoft Entra ID Protection, Sentinel analytics, or the Sigma/KQL content above, you must have alerting that fires within minutes — not a breach that runs for days.
  4. Audit mailbox audit logging. Confirm AuditEnabled is true for all mailboxes and that MailItemsAccessed events are captured (requires appropriate licensing). You cannot scope a breach you cannot see.

Near-Term (30–90 days)

  1. Conduct a genuine enterprise-wide security risk analysis. This was OCR's core finding. The risk analysis must cover every system that creates, receives, maintains, or transmits ePHI — including email, cloud services, medical devices, and business associate data flows. It must be documented, current, and drive a risk management plan with owners and deadlines. A checkbox risk analysis is worse than none at all in an OCR investigation.
  2. Minimize PHI in email. The breach magnitude — 232,000 records from one mailbox — was a data governance failure as much as a security failure. Implement policies and technical controls (DLP, secure messaging portals) to keep clinical communications out of standard email, and enforce mailbox retention limits.
  3. Business associate and access review. Inventory who has access to what PHI, review service accounts and delegated mailbox permissions, and remove anything not operationally justified.

Ongoing

  1. Tabletop and technical detection testing. Run purple team exercises simulating email account compromise. Verify your SOC actually detects the behaviors in the rules above — don't assume.
  2. Workforce phishing training with simulation. Healthcare staff are high-value targets. Quarterly simulations with remedial training for repeat clickers measurably reduce credential compromise rates.
  3. Prepare for OCR scrutiny before OCR arrives. Document everything: risk analyses, remediation plans, incident response actions, training records. In OCR enforcement, the quality of your documentation frequently determines the difference between a technical assistance letter and a six-figure civil monetary penalty.

The Ambry Genetics settlement is not an anomaly — it is OCR's template. Healthcare organizations that treat email security, risk analysis, and audit logging as foundational (rather than aspirational) will be both harder to breach and far better positioned if a breach does occur.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub

healthcare-cybersecurityhipaa-compliancehealthcare-ransomwareehr-securitymedical-data-breachambry-geneticshipaa-settlementemail-account-compromisehealthcare-breachphi-protection

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action