American Addiction Centers & Oculus Pathology Breach Disclosures: Defense, Detection, and HIPAA Response Playbook for Healthcare

American Addiction Centers (AAC), headquartered in Tennessee and operating one of the largest substance-use-disorder treatment networks in the country, and Oculus Pathology, a Texas-based pathology laboratory, have both disclosed hacking incidents resulting in unauthorized access to systems containing protected health information (PHI). Regional Center of Orange also appears in this wave of disclosures — a pattern that has become painfully familiar: threat actors continue to find healthcare's combination of high-value data, legacy infrastructure, and operational fragility irresistible.

For defenders, the specifics of these incidents matter less for what they tell us about these two organizations and more for what they confirm about the state of healthcare intrusion tradecraft in 2026. Behavioral health records — including substance use disorder treatment data protected under 42 CFR Part 2 in addition to HIPAA — carry extreme black-market value and exceptional regulatory exposure. Pathology laboratories hold dense, structured PHI datasets (names, DOBs, SSNs, diagnoses, insurance identifiers) that are purpose-built for identity theft and insurance fraud. Both are exactly the data classes that extortion crews prioritize.

If you run security for a treatment center, laboratory, or any HIPAA covered entity, treat these disclosures as a free table-top exercise: walk your environment through the attack chain below and confirm you can see each stage.

Technical Analysis: The Typical Attack Chain Behind These Incidents

While neither disclosure names a CVE or specific initial access vector publicly, healthcare intrusions of this class overwhelmingly follow a small number of well-worn paths. Based on the incident profiles (multi-week access windows, large PHI datasets staged and exfiltrated, delayed detection discovered through forensic investigation rather than internal alerting), defenders should assume the following attack chain:

Stage 1 — Initial Access. The dominant vectors in recent healthcare breaches remain (a) credential-based access through phishing or purchased credentials against externally exposed services (VPN, RDP, M365/Okta SSO portals), (b) exploitation of internet-facing appliances, and (c) third-party/vendor compromise. Behavioral health providers are frequently targeted via phishing because their workforces are large, clinical, and not security-trained to the level of, say, a hospital IT shop.

Stage 2 — Persistence and Privilege Escalation. Threat actors establish persistence via scheduled tasks, new local/domain accounts, or compromised service accounts, then escalate via weak service account hygiene, exposed admin shares, or harvested credentials from LSASS memory on unhardened endpoints.

Stage 3 — Discovery and Collection. Attackers enumerate file shares, EHR exports, laboratory information system (LIS) databases, and SQL Server instances. A hallmark of healthcare breaches: PHI is often found in unmanaged locations — CSV exports on file servers, report dumps, scanned document repositories — outside the EHR's own access controls.

Stage 4 — Staging and Exfiltration. Data is compressed (often with 7-Zip or WinRAR from non-standard paths) and exfiltrated via Rclone/mega/file.io-style cloud tools, or over HTTPS to attacker infrastructure. This stage generates the highest-fidelity, lowest-noise detections available to defenders — which is why the detection content below concentrates there.

Exploitation status: These are confirmed, completed intrusions with data theft — not theoretical. Healthcare remains one of the most-breached sectors on HHS OCR's breach portal, and the dwell-time pattern in these disclosures (incident discovered well after initial access) indicates detection gaps, which is precisely what this post addresses.

Detection & Response

The rules and hunts below target the highest-signal stages of this attack chain: mass PHI access, data staging with compression utilities, exfiltration tooling, and persistence. They are tuned to be useful in a real healthcare SOC — not theoretical fireworks.

Sigma Rules

The following rules detect compression-based data staging and cloud exfiltration tool execution — two behaviors present in the overwhelming majority of healthcare data-theft incidents:

YAML

---
title: Data Staging via Compression Utility from Non-Standard Path
id: 3f8a1c74-9b2e-4d61-a8c3-7e5f2b9d4012
status: experimental
description: Detects 7-Zip, WinRAR, or similar compression utilities executing from user-writable or non-standard paths, a common data-staging behavior observed in healthcare breach intrusions prior to exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_path:
    Image|contains:
      - '\Users\Public\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\PerfLogs\'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' -p'
      - '.zip'
      - '.7z'
      - '.rar'
  condition: selection_img and (selection_path or selection_cli)
falsepositives:
  - Users legitimately compressing files in their own profile directories
  - IT backup or archival scripts using 7-Zip from ProgramData
level: medium
---
title: Cloud Exfiltration Tool Execution (Rclone or Similar)
id: 8c2d5e91-4a7b-4f38-b6d2-1e9c3a7f5024
status: experimental
description: Detects execution of Rclone or renamed copies of cloud sync/exfiltration tools, frequently used by threat actors to exfiltrate staged PHI from healthcare environments to cloud storage.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\megasync.exe'
      - '\filezilla.exe'
      - '\winscp.exe'
  selection_original:
    OriginalFileName|contains:
      - 'rclone'
      - 'MEGAcmd'
  selection_cli:
    CommandLine|contains:
      - 'copy '
      - 'sync '
      - 'move '
      - '--transfers'
      - 'mega.nz'
      - 'file.io'
      - 'transfer.sh'
      - 'pastebin'
  condition: (selection_name or selection_original) and selection_cli
falsepositives:
  - Legitimate use of Rclone or FileZilla by IT for sanctioned transfers — maintain an approved-tool inventory and whitelist known admin hosts
level: high
---
title: New Local Administrator Account Creation Followed by Immediate Use
id: 5b1e9d36-2c8f-4a47-9e3b-6d4a8f1c6035
status: experimental
description: Detects net.exe or PowerShell-based creation of local user accounts and addition to the Administrators group, a persistence technique common in healthcare intrusions where EDR coverage is inconsistent across clinical endpoints.
references:
  - https://attack.mitre.org/techniques/T1136/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_net:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - 'user'
      - '/add'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'New-LocalUser'
      - 'Add-LocalGroupMember'
      - 'Add-ADGroupMember'
  condition: 1 of selection_*
falsepositives:
  - Legitimate account provisioning by helpdesk or imaging workflows — correlate with change tickets and known admin accounts
level: high

KQL Hunt — Microsoft Sentinel / Defender

This query hunts for the staging-to-exfil sequence: a compression utility creating an archive, followed by outbound transfer activity from the same device — the pattern most indicative of PHI theft in progress. Run it against a 7-day window and tune the device allowlist for known backup servers:

KQL — Microsoft Sentinel / Defender

let lookback = 7d;
let StagingDevices = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe", "rclone.exe")
| where ProcessCommandLine has_any (" a ", "-p", "copy", "sync", ".zip", ".7z", ".rar")
| summarize FirstStaging=min(TimeGenerated), StagingCmd=any(ProcessCommandLine) by DeviceId, DeviceName, InitiatingProcessAccountName;
let ExfilActivity = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has_any ("mega.nz", "file.io", "transfer.sh", "anonfiles", "gofile.io", "wetransfer", "dropbox", "storage.googleapis")
   or (RemotePort in (443, 22, 21) and ActionType == "ConnectionSuccess")
| summarize ExfilEvents=count(), FirstExfil=min(TimeGenerated), RemoteIPs=make_set(RemoteIP, 10), RemoteURLs=make_set(RemoteUrl, 10) by DeviceId;
StagingDevices
| join kind=inner ExfilActivity on DeviceId
| where FirstExfil >= FirstStaging
| extend HoursBetween = datetime_diff('hour', FirstExfil, FirstStaging)
| project DeviceName, InitiatingProcessAccountName, FirstStaging, StagingCmd, FirstExfil, ExfilEvents, RemoteIPs, RemoteURLs
| order by FirstStaging desc

A second, cheaper hunt worth running weekly against PHI-adjacent servers (file servers, LIS/EHR database hosts) — mass file access by a single account, a strong indicator of collection activity:

KQL — Microsoft Sentinel / Defender

let lookback = 7d;
SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID == 4663
| where ObjectType == "File"
| where ObjectName has_any ("\\PHI", "\\PatientData", "\\Reports", "\\Exports", ".csv", ".pdf", ".xlsx")
| summarize FileAccessCount=count(), DistinctFiles=dcount(ObjectName), SampleFiles=make_set(ObjectName, 5)
    by SubjectUserName, IpAddress, Computer
| where DistinctFiles > 200
| order by DistinctFiles desc

Velociraptor VQL — Endpoint Hunt

Use this artifact across clinical and administrative endpoints to surface staging artifacts (recently created archives in user-writable paths) and exfiltration tools simultaneously:

VQL — Velociraptor

-- Hunt for data staging archives and exfiltration tooling on endpoints
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Users/*/AppData/**/*.zip',
  'C:/Users/*/AppData/**/*.7z',
  'C:/Users/*/AppData/**/*.rar',
  'C:/Users/Public/**/*.zip',
  'C:/Users/Public/**/*.7z',
  'C:/ProgramData/**/*.7z',
  'C:/ProgramData/**/*.rar'
])
WHERE Mtime > now() - 86400 * 14
  AND Size > 10000000
UNION ALL
SELECT Exe AS FullPath, 0 AS Size, NULL AS Mtime, NULL AS Btime
FROM pslist()
WHERE Name =~ '(?i)rclone|megacmd|megasync|winscp|filezilla'
   OR CommandLine =~ '(?i)rclone.*(copy|sync|move)|--transfers'

Remediation & Hardening Script

This PowerShell script hardens Windows endpoints against the exact behaviors above: it enables the audit policies needed to detect PHI access, blocks unsigned compression/exfil tools via AppLocker-style checks (as an audit verification), confirms LSASS protection, and inventories suspicious staging artifacts. Run it as a verification pass across your fleet, not a one-time fix:

PowerShell

# Healthcare Breach Hardening & Verification Script — run elevated
# 1. Enable file/object access auditing on PHI directories (required for the 4663 hunt above)
$phiPaths = @("D:\Shares\PHI", "D:\Shares\PatientData", "D:\Shares\Exports")
foreach ($path in $phiPaths) {
  if (Test-Path $path) {
    $acl = Get-Acl $path
    $rule = New-Object System.Security.AccessControl.FileSystemAuditRule(
      "Everyone","ReadData","ContainerInherit,ObjectInherit","None","Success")
    $acl.AddAuditRule($rule)
    Set-Acl $path $acl
    Write-Host "[+] Auditing enabled on $path"
  }
}

# 2. Enable required audit policies for intrusion detection
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
auditpol /set /subcategory:"File System" /success:enable /failure:enable
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
# Enable process command-line capture (Event 4688)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" `
  -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -Force

# 3. Verify LSASS protection against credential dumping
$lsa = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -ErrorAction SilentlyContinue
if ($lsa.RunAsPPL -ne 1) {
  Write-Host "[!] LSASS PPL NOT enabled — set RunAsPPL=1 and reboot"
}

# 4. Inventory exfiltration-capable tools and large recent archives
Get-ChildItem -Path C:\Users,C:\ProgramData -Recurse -Include `n  rclone.exe,megacmd.exe,megasync.exe -ErrorAction SilentlyContinue |
  Select-Object FullName, Length, LastWriteTime
Get-ChildItem -Path C:\Users,C:\ProgramData -Recurse -Include *.7z,*.rar,*.zip `
  -ErrorAction SilentlyContinue | Where-Object {
    $_.Length -gt 50MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-14)
  } | Select-Object FullName, Length, LastWriteTime | Sort-Object Length -Descending

Remediation: What Healthcare Organizations Must Do Now

There is no patch for "we got breached" — the remediation here is architectural and procedural. Prioritize in this order:

Enforce phishing-resistant MFA on every externally reachable service — VPN, SSO, RDP gateways, and especially remote access used by third-party vendors. Credential replay remains the front door in most healthcare intrusions.
Inventory your PHI outside the EHR. The unmanaged copies — report exports, scanned-document shares, SQL dumps — are what attackers actually steal. Map them, apply object-access auditing (script above), and delete what you don't need.
Deploy and verify detection, not just collection. These incidents were discovered during forensic investigation, meaning logs existed but nobody was alerted. Deploy the Sigma rules above into your SIEM and validate the KQL hunts against your Sentinel workspace this week.
Block or alert on exfiltration tooling. Rclone, MEGAsync, and unsanctioned cloud storage destinations have no business on clinical endpoints. Application control (WDAC/AppLocker) plus the high-level rule above gives you both prevention and detection.
Segment clinical networks from administrative networks, and restrict SMB/RPC lateral movement between workstation VLANs and server segments hosting LIS/EHR databases.
Pressure-test your HIPAA IR runbook. Breach notification obligations (HHS OCR within 60 days for 500+ individuals, state AG notifications, media notification) have hard clocks. Organizations that discover these obligations mid-incident blow their timelines. If you hold substance use disorder records, confirm your 42 CFR Part 2 handling is current.
Review third-party/vendor access. Pathology labs and treatment networks lean heavily on external billing, IT, and lab-service vendors. Audit their access paths, enforce least privilege, and require MFA — vendor compromise is a recurring initial-access story in this sector.

Monitor the HHS OCR breach portal for the formal entries on these incidents; the reported record counts and attack descriptions there will tell you whether these were ransomware-adjacent events, pure data theft, or business email compromise spillover — each of which should shift your tuning priorities.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub