Brevard Skin and Cancer Center Breach Settlement: Detection and Remediation Playbook for Healthcare Defenders

Brevard Skin and Cancer Center, a Florida dermatology practice, has agreed to settle class action litigation arising from a data breach that exposed patients' protected health information (PHI) and personally identifiable information (PII). The settlement closes the legal chapter — but for defenders, the operational chapter never closes. This incident follows a pattern I have seen repeatedly across 15 years of IR work: a small-to-midsize specialty practice, running lean IT with limited security staffing, suffers unauthorized network access. Patient records — names, dates of birth, Social Security numbers, diagnoses, treatment details, and insurance information — are accessed and exfiltrated. Months later come the OCR notification, the credit monitoring offers, the class action, and the settlement.

Healthcare remains one of the most-breached sectors year over year, and specialty practices like dermatology clinics are disproportionately attractive targets: they hold dense PHI, often lack a dedicated SOC, rely on third-party EHR and billing platforms, and frequently have flat networks with legacy endpoints. The financial exposure is no longer limited to regulatory penalties — class action settlements now routinely attach seven-figure price tags to breaches at organizations of this size. If you defend a healthcare environment, treat this story as a forcing function: validate that you can actually see the behaviors that lead to PHI exfiltration before you are the next settlement headline.

Technical Analysis

Because the public reporting on the Brevard Skin and Cancer Center settlement focuses on the litigation rather than granular intrusion mechanics, I will not fabricate an attack vector or CVE. Instead, I will break down the attack chain that dominates breaches of this class — unauthorized access to a healthcare network followed by PHI staging and exfiltration — because that is what your detection stack must be tuned against.

Affected Environment Profile

Specialty medical practices typically present the following exposure surface:

EHR/PM platforms (cloud-hosted or on-premises) holding longitudinal patient records
Windows domain environments with file shares containing scanned documents, referral letters, and exported reports
Microsoft 365 / Exchange Online tenants used for patient communication and billing — frequently without enforced MFA on every account
Vendor remote access (EHR support, IT MSPs) via RMM tools or VPN, often with standing credentials
Endpoints running legacy OS builds in exam rooms and front-desk workstations

The Typical Attack Chain

In healthcare breach engagements I have led, the chain most commonly looks like this:

Initial access — credential phishing against a staff mailbox, compromised RMM/vendor credentials, or exploitation of an exposed remote access service.
Persistence and discovery — the attacker enumerates shares, identifies the EHR data stores, document repositories, and backup locations.
Collection and staging — PHI is aggregated and compressed using legitimate archivers (7-Zip, WinRAR) into staging directories, frequently under user-writable paths like C:\Users\Public\, C:\ProgramData\, or %TEMP%.
Exfiltration — staged archives leave via HTTPS to cloud storage, attacker infrastructure, or — in email-compromise scenarios — mailbox export and forwarding rules silently siphon data over weeks.
Extortion or monetization — data is leaked or sold; patients receive breach notices; litigation follows.

Exploitation Status

There is no CVE or zero-day associated with this news item, and none should be assumed. The defensive lesson is behavioral: these breaches overwhelmingly succeed through living-off-the-land techniques and legitimate administrative tooling, which means signature-only defenses miss them. Detection must focus on data staging, anomalous file access volume, and mailbox manipulation.

Detection & Response

The detections below target the staging, collection, and mailbox-abuse behaviors that precede PHI exposure in healthcare intrusions. They are deliberately narrow — tuned to fire on activity that has no legitimate reason to occur at scale in a clinical environment.

Sigma Rules

YAML

---
title: PHI Staging via Archive Utility in User-Writable Path
id: 3f8c2a91-7b4d-4e61-9c05-2a6d8f1b3e47
status: experimental
description: Detects compression utilities creating archives in directories commonly abused for data staging prior to exfiltration in healthcare intrusions.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.hipaajournal.com/brevard-skin-cancer-center-data-breach-settlement/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' u '
  selection_path:
    CommandLine|contains:
      - 'C:\Users\Public\'
      - 'C:\ProgramData\'
      - '\AppData\Local\Temp\'
  condition: selection_img and selection_cli and selection_path
falsepositives:
  - IT packaging or backup scripts using 7-Zip — whitelist known admin accounts and paths
level: high
---
title: Suspicious Mailbox Export or Search Export in Exchange
id: 91d4e7b2-5c3a-4f08-8d16-4b2c9e7a1f53
status: experimental
description: Detects mailbox export requests and eDiscovery exports, a common mechanism for bulk PHI theft following email account compromise at medical practices.
references:
  - https://attack.mitre.org/techniques/T1114/002/
  - https://www.hipaajournal.com/brevard-skin-cancer-center-data-breach-settlement/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1114.002
  - attack.exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'New-MailboxExportRequest'
      - 'New-ComplianceSearchAction'
      - 'Export-Mailbox'
  condition: selection
falsepositives:
  - Legitimate litigation-hold or migration activity — correlate with change tickets and approved admin accounts
level: high

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt 1: Archiver-based staging in user-writable paths (endpoints across the practice)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe")
| where ProcessCommandLine has_any ("C:\\Users\\Public\\", "C:\\ProgramData\\", "AppData\\Local\\Temp")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc;

// Hunt 2: Anomalous volume of sensitive-object file access per account (mass PHI reads)
// Requires Object Access auditing (4663) on PHI file shares
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4663
| where ObjectType == "File"
| where ObjectName has_any ("\\Patients\\", "\\EHR\\", "\\MedicalRecords\\", "\\Billing\\")
| summarize FileAccessCount = count(), DistinctFiles = dcount(ObjectName) by Account, Computer, bin(TimeGenerated, 1h)
| where DistinctFiles > 200
| order by DistinctFiles desc;

// Hunt 3: Inbox forwarding rules pointing to external domains (mailbox-compromise exfil)
// Ingest OfficeActivity or unified audit logs into Sentinel for this query
OfficeActivity
| where TimeGenerated > ago(14d)
| where Operation in~ ("New-InboxRule", "Set-InboxRule", "Set-Mailbox")
| where Parameters has_any ("ForwardTo", "ForwardingSmtpAddress", "RedirectTo")
| extend Parsed = parse_json(Parameters)
| mv-apply p = Parsed on (
    where p.Name in~ ("ForwardTo", "ForwardingSmtpAddress", "RedirectTo")
    | project ForwardTarget = tostring(p.Value))
| where ForwardTarget !contains "yourdomain.com"
| project TimeGenerated, UserId, ClientIP, Operation, ForwardTarget
| order by TimeGenerated desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for recently created archives in staging paths indicative of PHI collection
LET staging_paths = [
  'C:/Users/Public/**.{zip,rar,7z}',
  'C:/ProgramData/**.{zip,rar,7z}',
  'C:/Users/*/AppData/Local/Temp/**.{zip,rar,7z}'
]

SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=staging_paths)
WHERE Mtime > now() - 604800
  AND Size > 10485760
ORDER BY Mtime DESC

Remediation and Audit Script

The following PowerShell audits a Microsoft 365 / Exchange environment for the mailbox-abuse indicators most relevant to this breach class, and validates that auditing is actually enabled — a gap I find in nearly every small-practice IR engagement.

PowerShell

# Audit mailbox forwarding rules, export requests, and audit logging posture
# Run from an Exchange Online / Graph-connected session with appropriate admin rights

Connect-ExchangeOnline

Write-Host "=== Mailboxes with forwarding configured ===" -ForegroundColor Cyan
Get-Mailbox -ResultSize Unlimited | Where-Object {
    $_.ForwardingAddress -ne $null -or $_.ForwardingSmtpAddress -ne $null
} | Select-Object DisplayName, PrimarySmtpAddress, ForwardingAddress, ForwardingSmtpAddress, DeliverToMailboxAndForward

Write-Host "=== Inbox rules with external forward/redirect ===" -ForegroundColor Cyan
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
    $mbx = $_.PrimarySmtpAddress
    Get-InboxRule -Mailbox $mbx -ErrorAction SilentlyContinue | Where-Object {
        $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo
    } | Select-Object @{N='Mailbox';E={$mbx}}, Name, ForwardTo, RedirectTo
}

Write-Host "=== Active mailbox export requests (on-prem Exchange) ===" -ForegroundColor Cyan
Get-MailboxExportRequest -ErrorAction SilentlyContinue | Get-MailboxExportRequestStatistics -ErrorAction SilentlyContinue |
    Select-Object SourceAlias, Status, FilePath, BytesTransferred

Write-Host "=== Mailbox audit logging status (must be $true on every mailbox) ===" -ForegroundColor Cyan
Get-Mailbox -ResultSize Unlimited | Where-Object { $_.AuditEnabled -eq $false } |
    Select-Object DisplayName, PrimarySmtpAddress, AuditEnabled

Write-Host "=== Remediate: enable auditing on all mailboxes ===" -ForegroundColor Cyan
# Uncomment after review:
# Get-Mailbox -ResultSize Unlimited | Where-Object { $_.AuditEnabled -eq $false } |
#     Set-Mailbox -AuditEnabled $true -AuditOwner MailboxLogin, HardDelete, SoftDelete, Update, MoveToDeletedItems

Remediation

Whether you operate a specialty practice or provide MDR services to one, the following actions address the control gaps this incident class exposes:

Enforce phishing-resistant MFA everywhere. Every mailbox, EHR portal, VPN, and vendor remote-access path — no exceptions for physicians or executives. Credential theft against a single front-desk account is the most common entry point in breaches of this profile.
Eliminate standing vendor access. RMM tools and EHR vendor support accounts should be just-in-time, MFA-gated, and logged. Audit every third-party account quarterly.
Enable and retain audit logging. Confirm mailbox auditing (now on by default in M365, but verify), enable Object Access auditing on PHI file shares, and centralize logs off-box. You cannot investigate what you did not record — and OCR will ask.
Deploy the detections above into your SIEM/EDR stack and validate them with purple-team staging simulations (compress dummy PHI files in C:\Users\Public\, create a test forwarding rule).
Segment clinical networks. EHR servers, imaging systems, and front-desk workstations should not share a flat VLAN. Exfiltration blast radius is determined by segmentation.
Encrypt PHI at rest and minimize retention. Data you do not retain cannot be breached. Purge legacy scanned-document stores on a defined schedule.
Rehearse the breach-notification clock. HIPAA requires individual notification within 60 days of discovery and OCR reporting for breaches of 500+ records. Class action exposure is amplified by delayed or inconsistent notification — your IR retainer and counsel should be engaged in hours, not weeks.
Review cyber liability coverage against current settlement benchmarks; class action outcomes in healthcare breaches have materially raised the financial floor.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub