American Vision Partners $1.75M HIPAA Breach Settlement: Detection and Hardening Guide for Healthcare Defenders

Medical Management Resource Group LLC, doing business as American Vision Partners — one of the largest eye care practice management organizations in the United States — has agreed to pay $1.75 million to settle class action litigation arising from a data breach that compromised the protected health information (PHI) of approximately 2.35 million individuals. The breach, which involved unauthorized access to the company's network and systems hosting patient data, exposed a combination of names, dates of birth, Social Security numbers, medical information, and health insurance details.

This settlement matters to defenders for two reasons. First, it confirms what we've been telling healthcare CISOs for years: the financial tail of a breach now extends well beyond OCR penalties and notification costs into multi-year class action exposure with eight-figure defense costs. Second, the intrusion pattern in this case — an attacker gaining a foothold on a healthcare network, dwelling long enough to locate and access systems containing ePHI, and exfiltrating at scale — is entirely detectable with controls that most mid-size healthcare organizations already own but have not configured. This post breaks down the defensive lessons and gives you concrete detection and hardening content to close the gaps this breach exploited.

Technical Analysis

What Happened

Per the litigation and prior reporting, attackers gained unauthorized access to American Vision Partners' network environment and accessed files containing patient data belonging to the organization's network of ophthalmology and optometry practices. The affected population — roughly 2.35 million patients — reflects the aggregation risk inherent to practice management organizations (PMOs) and management services organizations (MSOs): a single intrusion into the management layer compromises every affiliated practice at once.

The exposed data classes are the classic high-value PHI triad for identity theft and medical fraud:

• Identifiers: full names, dates of birth
• Financial/identity keys: Social Security numbers
• Clinical context: medical treatment information, health insurance data

No CVE is associated with this incident in the public reporting — this was a network intrusion and data access event, not a disclosed software vulnerability. That distinction matters: the failure mode here is detection and segmentation, not patch management.

The Attack Chain — Defender's View

Healthcare intrusions of this type almost universally follow the same observable chain:

1. Initial access — phishing-delivered credential theft, exposed RDP/VPN, or a compromised third party with network trust into the management organization.
2. Discovery — enumeration of file shares, servers, and databases. Attackers hunt for directories named for patients, billing, HR, or practice acquisitions.
3. Collection — bulk reads of PHI repositories, frequently followed by staging into archives (.zip, .7z, .rar) on an intermediate server.
4. Exfiltration — large outbound transfers to attacker-controlled infrastructure, often over HTTPS to cloud storage or via tools like Rclone.
5. Extortion/impact — in double-extortion scenarios, encryption follows exfiltration.

The litigation-driven fact pattern here — multi-million-record exposure with no reported encryption event in the settlement coverage — points to a quiet data theft scenario. Those are the hardest to catch and the ones where egress monitoring and file access auditing pay for themselves.

Exploitation Status

There is no vulnerability to patch and no KEV entry. The "exploit" is the absence of layered controls: insufficient network segmentation between the management organization and practice data, inadequate file access auditing on PHI repositories, and no egress anomaly detection to catch the bulk transfer. Every stage of the chain above generates telemetry. If your SOC isn't collecting it, you are one motivated affiliate away from your own eight-figure settlement.

Detection & Response

The detections below target the collection and exfiltration stages, where defender ROI is highest and false positive rates are manageable. Tune thresholds to your environment's baseline before enabling alerting.

Sigma Rules

---
title: Bulk Archive Creation in Healthcare PHI or File Server Directories
id: 3f8a2c41-9b6e-4d21-a7f5-2c9e1b8d4a01
status: experimental
description: Detects compression utilities creating archives in directories likely to contain PHI or bulk patient data, a common staging behavior before exfiltration in healthcare breaches.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winzip64.exe'
  selection_cmd:
    CommandLine|contains:
      - ' a '
      - ' u '
  selection_path:
    CommandLine|contains:
      - '\Patient'
      - '\PHI'
      - '\Medical'
      - '\Billing'
      - '\Shares\'
      - '\HR\'
  condition: selection_tool and selection_cmd and selection_path
falsepositives:
  - Scheduled backup jobs using 7-Zip or WinRAR — baseline and allowlist by service account and schedule
level: high
---
title: Rclone or Cloud Sync Tool Execution on Servers Hosting PHI
id: 8c1e7b32-4f5a-4c09-b2d8-7e3a6f1c9b55
status: experimental
description: Detects execution of Rclone or similar cloud sync/exfiltration tools on server systems, a strong indicator of data theft staging in healthcare intrusions.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\aws.exe'
      - '\azcopy.exe'
  selection_cmd:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
  filter_known:
    CommandLine|contains:
      - 'backup-schedule'
  condition: selection_img and selection_cmd and not filter_known
falsepositives:
  - Legitimate cloud backup tooling — allowlist signed binaries at known install paths and approved service accounts
level: critical
---
title: Mass File Read Activity by a Single User on File Servers
id: 5d2f9e14-6a8b-4c37-91e4-3b7c2f8a6d02
status: experimental
description: Detects an abnormally high volume of file access events from a single account against a file server, consistent with bulk PHI collection during an intrusion. Requires Windows File System auditing (Event 4663) and a tuning threshold appropriate to the environment.
references:
  - https://attack.mitre.org/techniques/T1213/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1213
logsource:
  category: file_event
  product: windows
detection:
  selection:
    ObjectType: 'File'
    AccessMask|contains:
      - '0x1'
      - '0x20089'
  filter_backup:
    SubjectUserName|endswith: '$'
  condition: selection and not filter_backup
falsepositives:
  - Backup agents, DLP scanners, and EDR indexing — exclude service accounts and tune volume thresholds per server role
level: medium

KQL — Microsoft Sentinel / Defender

This hunt identifies users with anomalously high file access volume combined with subsequent outbound transfer from the same device — the collection-to-exfiltration correlation that characterizes healthcare data theft.

// Hunt: anomalous file read volume on servers followed by large egress
let Lookback = 7d;
let ReadThreshold = 5000;
let EgressMBThreshold = 500;
let HeavyReaders =
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where ActionType == "FileModified" or ActionType == "FileCreated"
    | where FolderPath has_any ("Patient", "PHI", "Medical", "Billing", "Shares")
    | summarize FileOps = count(), DistinctFiles = dcount(FileName) by DeviceName, InitiatingProcessAccountName
    | where FileOps > ReadThreshold;
let Egress =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteIPType == "Public"
    | summarize BytesOut = sum(tolong(InitiatingProcessFileSize)), Connections = count(), RemoteIPs = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName
    | where Connections > 100;
HeavyReaders
| join kind=inner Egress on DeviceName
| project DeviceName, InitiatingProcessAccountName, FileOps, DistinctFiles, Connections, RemoteIPs, InitiatingProcessFileName
| order by FileOps desc

For environments forwarding Windows Security events to Sentinel, this companion query surfaces archive-utility execution on servers:

// Hunt: compression/exfil tooling execution on servers (SecurityEvent 4688)
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| where NewProcessName has_any ("7z.exe", "7za.exe", "rar.exe", "rclone.exe", "megacmd.exe", "azcopy.exe")
| where CommandLine has_any (" a ", " sync", " copy", " move")
| where Account !endswith "$"
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Runs = count(), Cmdlines = make_set(CommandLine, 5) by Computer, Account, NewProcessName
| order by Runs desc

Velociraptor VQL

Use this artifact for rapid triage across healthcare file servers to find recently created archives — staging artifacts left behind before or during exfiltration.

-- Hunt for recently created archives in PHI-adjacent directories (staging indicator)
LET archive_globs = {
  SELECT FullPath, Size, Mtime
  FROM glob(globs=['C:/Shares/**/*.zip', 'C:/Shares/**/*.7z', 'C:/Shares/**/*.rar',
                   'D:/Data/**/*.zip', 'D:/Data/**/*.7z',
                   'C:/Users/*/AppData/Local/Temp/**/*.zip'])
}
SELECT FullPath, Size,
       timestamp(epoch=Mtime) AS ModifiedTime
FROM archive_globs
WHERE Mtime > (now() - 604800)   -- last 7 days
  AND Size > 10485760            -- >10 MB, filter trivial temp archives
ORDER BY Size DESC

Hardening Script

The following PowerShell enables the object access auditing and applies SACLs to PHI shares so the detections above actually have telemetry to work with. Run elevated on each file server hosting patient data.

# Enable advanced file system auditing required for bulk-read detection
auditpol /set /subcategory:"File System" /success:enable /failure:disable
auditpol /set /subcategory:"File Share" /success:enable /failure:disable
auditpol /set /subcategory:"Detailed File Share" /success:enable /failure:disable

# Apply a read-access SACL to PHI directories so 4663 events are generated
$phiPaths = @("D:\Shares\PatientData", "D:\Shares\Billing")  # adjust to your shares
foreach ($path in $phiPaths) {
    if (Test-Path $path) {
        $acl = Get-Acl -Path $path -Audit
        $rule = New-Object System.Security.AccessControl.FileSystemAuditRule(
            "Everyone", "ReadData,ReadAttributes", "ContainerInherit,ObjectInherit",
            "None", "Success")
        $acl.AddAuditRule($rule)
        Set-Acl -Path $path -AclObject $acl
        Write-Output "[+] Audit SACL applied: $path"
    }
}

# Verify PowerShell script block + process creation logging for intrusion forensics
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -ErrorAction SilentlyContinue
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1

# Audit local administrators for unauthorized persistence accounts
Get-LocalGroupMember -Group "Administrators" | Select-Object Name, ObjectClass, PrincipalSource | Format-Table -AutoSize

# Confirm Defender tamper protection and PUA blocking (blocks rclone/megacmd abuse)
Get-MpComputerStatus | Select-Object IsTamperProtected, PUAProtection, RealTimeProtectionEnabled | Format-List

Remediation

There is no patch here — remediation is architectural. Prioritize in this order:

1. Segment the management layer from practice data. American Vision Partners' exposure was amplified because a single management-organization intrusion reached data for dozens of affiliated practices. Enforce VLAN/NSG segmentation, deny lateral SMB/RDP between workstations and PHI servers, and require jump-host access for administrative paths. Map this to NIST CSF PR.AC and CIS Control 12.
2. Instrument PHI repositories for access auditing. Deploy the SACL configuration above on every share and database server holding ePHI. Forward 4663/4660 and Detailed File Share events to your SIEM. Without this telemetry, bulk collection is invisible — as it apparently was here.
3. Deploy egress controls and anomaly detection. Default-deny outbound from servers except to approved destinations; alert on new public destinations, unusual byte volumes, and consumer cloud storage domains. Block Rclone, MEGAcmd, and unapproved sync tools via AppLocker/WDAC or Defender PUA.
4. Enforce phishing-resistant MFA on all remote access — VPN, RDP gateways, email, and any third-party support tooling. Credential-based initial access remains the dominant healthcare intrusion vector.
5. Shrink the data footprint. The settlement size scales with records exposed. Purge or archive patient data beyond HIPAA retention requirements, de-identify where clinically permissible, and consolidate shadow copies of PHI in legacy systems inherited through practice acquisitions — a chronic problem in PMO/MSO roll-ups.
6. Test your IR plan against the litigation timeline. Plaintiffs' counsel will reconstruct your detection timeline. Your ability to produce logs showing time-to-detect, time-to-contain, and scoping rigor directly affects settlement exposure. Run a tabletop on a quiet-data-theft scenario, not just ransomware.
7. Review BAAs and third-party access. If a vendor or affiliate practice has network trust into your environment, their compromise is your breach. Audit those paths quarterly.

For healthcare organizations, this settlement is a proof point you can take to the board: 2.35 million records, $1.75M settlement, years of litigation — against detection controls that cost a fraction of that to deploy.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub