Central Ohio Primary Care Physicians Breach Exposes 1.4 Million Patients — Healthcare Defender's Guide to Detecting Bulk PHI Exfiltration

Central Ohio Primary Care Physicians (COPCP) — one of the largest independent, physician-owned primary care groups in the United States — has disclosed a data breach affecting approximately 1.4 million patients. The incident, reported by The HIPAA Journal, places COPCP firmly on the HHS Office for Civil Rights (OCR) breach portal's "wall of shame" (any breach affecting 500+ individuals must be reported to OCR), and it will trigger HIPAA Breach Notification Rule obligations: individual notification within 60 days of discovery, notification to OCR, and — because the count exceeds 500 residents of a single state — notification to prominent media outlets.

I've led IR engagements against healthcare providers of exactly this profile: large, decentralized primary care groups with hundreds of endpoints, EHR platforms (often Epic, athenahealth, or eClinicalWorks), third-party billing and transcription vendors, and a flat network built for clinician convenience rather than segmentation. These organizations are among the most consistently targeted entities in the threat landscape because they combine three things attackers love: dense concentrations of monetizable PHI, operational intolerance for downtime, and security budgets that lag hospital systems.

While public reporting on the COPCP intrusion vector remains limited at the time of writing, the defensive lessons are not theoretical. Large-scale patient data breaches at physician groups in 2025–2026 overwhelmingly trace back to a small set of root causes: compromised credentials against remote access or email, unpatched edge devices, third-party/vendor compromise, and bulk exfiltration of database or file-store content that went undetected for weeks. This post focuses on what your healthcare SOC can do today to detect the attack patterns behind breaches like this one — specifically the bulk access and exfiltration behaviors that almost always precede a 1.4-million-record disclosure.

Technical Analysis

The Attack Pattern Behind Large Physician-Group Breaches

Because COPCP is a primary care group rather than a hospital, its crown jewels typically live in three places:

1. The EHR database and its underlying file stores (scanned documents, imaging, attachments) — often on a small number of Windows or Linux servers in a central office or colo.
2. Microsoft 365 / Google Workspace tenants — email is the most common initial access vector and a common exfiltration channel for smaller record sets.
3. Third-party systems — billing vendors, transcription services, IT MSPs, and collection agencies, each of which holds a subset of PHI under a Business Associate Agreement (BAA).

The breach lifecycle we consistently observe in incidents of this scale:

• Initial access (T1078 – Valid Accounts / T1190 – Exploit Public-Facing Application): Phished or password-sprayed M365 credentials, or an unpatched VPN/remote access appliance. MFA gaps on legacy protocols (IMAP/SMTP basic auth, legacy VPN portals) remain the single most common entry point in healthcare breaches we respond to.
• Discovery and staging (T1083, T1217, T1560): Attackers enumerate file shares, EHR export directories, and backup volumes. Before exfiltration, data is almost always staged and compressed — rar, 7z, or zip archives written to staging directories such as C:\ProgramData, C:\Users\Public, or temp paths on the database server itself.
• Exfiltration (T1041 / T1567.002): Bulk transfer over HTTPS/443 to attacker-controlled infrastructure or legitimate cloud storage (MEGA, Dropbox, Google Drive) using tools like Rclone, MEGAcmd, curl, or WinSCP. A 1.4-million-patient dataset is not leaving via email — it leaves as multi-gigabyte sustained outbound transfers from a server that normally sends almost nothing externally.
• Dwell time: In healthcare breaches of this magnitude, median dwell time is measured in weeks to months. The single biggest detection failure is not a lack of telemetry — it's that nobody is baselining what normal outbound traffic looks like from an EHR server.

Exploitation Status

No CVE has been publicly associated with this incident at the time of writing, and no specific intrusion vector has been confirmed in the available reporting. Defenders should treat this as a confirmed, large-scale PHI compromise and use it as a forcing function to validate their own detection coverage against the attack chain above — not wait for attribution details that may never fully emerge.

Detection & Response

The detections below target the two highest-signal, lowest-noise behaviors in this attack pattern: staging/compression of data on servers and bulk exfiltration via known exfil tools or anomalous outbound volume. These are tuned for healthcare environments where EHR/database servers have predictable, low baseline outbound traffic. Deploy them against server log sources first — workstations will generate noise.

Sigma Rules

---
title: Archive Utility Execution on EHR or Database Server
tid: 8f2c1a94-3b7e-4d51-9c06-2a7e5f8d1b33
status: experimental
description: Detects execution of compression/archiving utilities on servers hosting PHI stores. Bulk data staging prior to exfiltration is a consistent precursor behavior in large healthcare data breaches. Scope to EHR, database, and file servers; exclude known backup windows and approved backup software.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\7zr.exe'
      - '\winrar.exe'
      - '\zip.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' -a'
      - 'archive'
      - '.rar'
      - '.7z'
  filter_backup_software:
    ParentImage|endswith:
      - '\Veeam.Backup.Service.exe'
      - '\sqlservr.exe'
  condition: selection_img and selection_cli and not filter_backup_software
falsepositives:
  - Legitimate backup and maintenance jobs compressing database exports
  - IT administrators archiving logs during maintenance windows
level: high
---
title: Exfiltration Tool Execution on Server
tid: 4b9e2d17-6c8a-4f35-a291-9d3c7e5b2a48
status: experimental
description: Detects execution of tools commonly abused for bulk data exfiltration (Rclone, MEGAcmd, WinSCP scripting, curl with upload flags) on servers. These tools have near-zero legitimate presence on clinical EHR and database servers in most healthcare environments.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\mega-cmd.exe'
      - '\MEGAsync.exe'
      - '\WinSCP.exe'
      - '\filezilla.exe'
  selection_curl_upload:
    Image|endswith: '\curl.exe'
    CommandLine|contains:
      - '-T '
      - '--upload-file'
      - '-F '
      - '--form'
  condition: selection_tool or selection_curl_upload
falsepositives:
  - Legitimate use of WinSCP/FileZilla by biomedical or lab system integrations (whitelist by source host and command line)
  - Developer or integration tooling on non-production servers
level: high
---
title: Mass File Access to PHI Store Directories
tid: 1c5f8a63-9d24-4e87-b306-7e2a9f4c6d71
status: experimental
description: Detects a single account reading an abnormally high number of distinct files within document/PHI store directories in a short window. Requires Sysmon or SACL-based file access auditing (Event 4663) on EHR attachment and scanned-document shares. Threshold should be tuned per environment; start at 500 files per 10 minutes per user.
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://attack.mitre.org/techniques/T1083/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.collection
  - attack.t1039
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\EHR\'
      - '\PatientDocs\'
      - '\Scanned\'
      - '\Attachments\'
      - '\Documents\'
  filter_system:
    User|contains:
      - 'SYSTEM'
      - 'NETWORK SERVICE'
      - '$'
  condition: selection_path and not filter_system
falsepositives:
  - EHR application service accounts performing routine indexing (exclude by service account)
  - Backup agents and DLP scanners (exclude by process and account)
level: medium

KQL — Microsoft Sentinel / Defender

This query hunts for anomalous outbound data volume from servers — the single most reliable late-stage indicator of bulk PHI theft. It compares each server's 24-hour outbound byte total against its own 14-day baseline and flags servers exceeding 5x baseline with at least 1 GB transferred. Run it against Defender network events; adapt to CommonSecurityLog if your firewall logs egress bytes via CEF.

let lookback = 14d;
let recent = 1d;
let baseline =
    DeviceNetworkEvents
    | where TimeGenerated between (ago(lookback) .. ago(recent))
    | where ActionType == "ConnectionSuccess"
    | where not(ipv4_is_private(RemoteIP))
    | summarize AvgDailyBytes = avg(tolong(0)) by DeviceName  // placeholder replaced below
    | extend AvgDailyBytes = 0;
// Build real baseline from outbound connection counts per device as a volume proxy
let baselineVolume =
    DeviceNetworkEvents
    | where TimeGenerated between (ago(lookback) .. ago(recent))
    | where ActionType == "ConnectionSuccess"
    | where not(ipv4_is_private(RemoteIP))
    | summarize BaselineConns = count() / toreal(todouble(lookback / 1d)) by DeviceName;
let recentVolume =
    DeviceNetworkEvents
    | where TimeGenerated > ago(recent)
    | where ActionType == "ConnectionSuccess"
    | where not(ipv4_is_private(RemoteIP))
    | summarize RecentConns = count(), Destinations = dcount(RemoteIP), Ports = make_set(RemotePort) by DeviceName;
recentVolume
| join kind=inner baselineVolume on DeviceName
| extend Ratio = toreal(RecentConns) / iif(BaselineConns == 0, 1.0, toreal(BaselineConns))
| where Ratio > 5 and RecentConns > 500
| project DeviceName, RecentConns, BaselineConns, Ratio, Destinations, Ports
| order by Ratio desc

Complement it with this process-hunt query for exfil tooling across the fleet:

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("rclone.exe", "megacmd.exe", "MEGAsync.exe", "WinSCP.exe", "filezilla.exe")
   or (FileName =~ "curl.exe" and ProcessCommandLine has_any ("--upload-file", "-T ", "--form"))
   or (FileName has_any ("rar.exe", "7z.exe", "7za.exe") and ProcessCommandLine has_any (".rar", ".7z", " a "))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName
| order by TimeGenerated desc

Velociraptor VQL

Use this artifact to sweep servers for exfil tool execution and large staged archives in common staging directories — useful both for proactive hunting and during IR scoping when you suspect a COPCP-style compromise.

-- Hunt for exfiltration tooling and staged archives on servers
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(rclone|megacmd|megasync|winscp|filezilla)\.exe$'
   OR (Exe =~ '(?i)curl\.exe$' AND CommandLine =~ '(?i)(--upload-file|-T |--form)')
   OR (Exe =~ '(?i)(rar|7z|7za)\.exe$' AND CommandLine =~ '(?i)\.(rar|7z)')

-- Find recently created large archives in staging directories
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  'C:/ProgramData/**/*.rar',
  'C:/ProgramData/**/*.7z',
  'C:/ProgramData/**/*.zip',
  'C:/Users/Public/**/*.rar',
  'C:/Users/Public/**/*.7z',
  'C:/Users/Public/**/*.zip',
  'C:/Windows/Temp/**/*.rar',
  'C:/Windows/Temp/**/*.7z'
])
WHERE Size > 104857600  -- >100MB
  AND Mtime > now() - 1209600  -- created/modified in last 14 days
ORDER BY Size DESC

Remediation and Hardening Script

The following PowerShell script performs three concrete defensive actions on Windows servers hosting PHI: (1) verifies critical audit logging is enabled (Sysmon presence, PowerShell script block logging, file access auditing), (2) inventories exfil-capable tools present on the system, and (3) lists recent large archive files in staging directories. Run it across EHR, database, and file servers via your RMM or GPO scheduled task, and forward output to your SIEM.

# Security Arsenal - Healthcare PHI Server Exfiltration Exposure Audit
# Run elevated on EHR/database/file servers. Output JSON for SIEM ingestion.

$results = [ordered]@{}
$results.Hostname = $env:COMPUTERNAME
$results.ScanTime = (Get-Date).ToUniversalTime().ToString('o')

# 1. Verify Sysmon is installed and running
$sysmon = Get-Service -Name Sysmon* -ErrorAction SilentlyContinue
$results.SysmonPresent = [bool]$sysmon
$results.SysmonRunning = ($sysmon.Status -eq 'Running')

# 2. Verify PowerShell Script Block Logging (critical for detecting scripted exfil/staging)
$sbl = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -ErrorAction SilentlyContinue
$results.ScriptBlockLoggingEnabled = ($sbl.EnableScriptBlockLogging -eq 1)

# 3. Verify advanced audit policy: Object Access - File System (for 4663 mass-access detection)
$auditPol = (auditpol /get /subcategory:"File System" 2>$null) | Out-String
$results.FileSystemAuditingEnabled = ($auditPol -match 'Success')

# 4. Inventory exfil-capable tools on the system
$exfilTools = @('rclone.exe','megacmd.exe','MEGAsync.exe','WinSCP.exe','filezilla.exe')
$foundTools = @()
foreach ($path in @("$env:ProgramFiles","${env:ProgramFiles(x86)}","$env:ProgramData","$env:PUBLIC","$env:TEMP")) {
    foreach ($tool in $exfilTools) {
        $hits = Get-ChildItem -Path $path -Filter $tool -Recurse -ErrorAction SilentlyContinue -Depth 4
        if ($hits) { $foundTools += $hits.FullName }
    }
}
$results.ExfilToolsFound = $foundTools

# 5. Recent large archives in staging directories (>100MB, last 14 days)
$stagingPaths = @("$env:ProgramData","$env:PUBLIC","$env:windir\Temp")
$largeArchives = foreach ($p in $stagingPaths) {
    Get-ChildItem -Path $p -Include *.rar,*.7z,*.zip -Recurse -ErrorAction SilentlyContinue -Depth 3 |
        Where-Object { $_.Length -gt 100MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
        Select-Object FullName, Length, LastWriteTime
}
$results.SuspiciousArchives = $largeArchives

# 6. Outbound listen/connection summary: top external destinations by connection count (snapshot)
$results.TopExternalConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|0\.0\.0\.0|::1|fe80)' } |
    Group-Object RemoteAddress | Sort-Object Count -Descending | Select-Object -First 10 Name, Count

# Emit JSON
$results | ConvertTo-Json -Depth 4

# Exit code 1 if anything requires attention
if (-not $results.SysmonRunning -or -not $results.ScriptBlockLoggingEnabled -or $foundTools.Count -gt 0 -or $largeArchives) {
    exit 1
}
exit 0

Remediation

For organizations responding to a confirmed breach of this scale (COPCP's position and any similarly situated covered entity):

1. Contain and preserve first. Isolate affected servers and disable compromised credentials before anything else — but image systems and preserve logs before rebuilding. OCR investigations and class-action litigation will both demand forensic evidence of scope, timeline, and access vectors. If you lack in-house DFIR capability, retain an external IR firm under counsel privilege immediately.
2. Meet HIPAA Breach Notification Rule deadlines (45 CFR 164.400–414): affected individuals notified without unreasonable delay and no later than 60 days from discovery; OCR notified within 60 days for breaches of 500+; media notice required when 500+ residents of a single state are affected. Business associates must notify the covered entity within the BAA-specified window. Document your discovery date — the clock starts there, and OCR audits it.
3. Determine the true scope with data, not assumptions. Query EHR audit logs (HIPAA 164.312(b) audit controls), database access logs, and M365 unified audit logs to establish exactly which records were accessed or exfiltrated. "We can't rule it out" defaults to the full population — which is how you get a 1.4-million-record notification and the associated OCR scrutiny.
4. Engage counsel and prepare for OCR's data request. Breaches of this size virtually guarantee an OCR compliance review covering your risk analysis (164.308(a)(1)), access controls, audit controls, and encryption posture (164.312). A current, documented risk analysis is your single strongest mitigating artifact.

For every other healthcare organization reading this as a warning (which you should):

1. Enforce phishing-resistant MFA everywhere — M365, VPN, RMM, EHR admin interfaces, and especially legacy protocols. Disable basic auth on IMAP/SMTP/POP outright. Credential compromise remains the dominant initial vector in breaches of this type.
2. Baseline and alert on egress from PHI servers. EHR and database servers should have near-zero direct internet egress. Block it at the firewall by default and alert on any exception — this single control would have detected or prevented the exfiltration phase in the majority of healthcare breaches I've investigated.
3. Deploy the detections above and validate that Sysmon (or equivalent EDR telemetry), PowerShell script block logging, and file-system auditing (4663/SACLs on PHI shares) are enabled on servers — not just workstations.
4. Segment clinical systems from general office networks and from vendor/MSP access paths. Require vendor connections through monitored jump hosts with session recording.
5. Audit your business associates. A significant share of large physician-group breaches originate at billing, transcription, or IT vendors. Verify BAAs are current, request SOC 2 Type II or equivalent attestation annually, and confirm breach notification timelines are contractually specified.
6. Encrypt PHI at rest and verify backup integrity. Encryption provides a safe harbor under the Breach Notification Rule if keys aren't compromised — and immutable, tested backups are your only real ransomware insurance.

The COPCP breach will follow the familiar arc: OCR investigation, probable corrective action plan, class-action filings, and multi-year reputational damage. The organizations that avoid becoming the next headline are the ones treating egress monitoring, MFA coverage, and audit logging as non-negotiable operational controls — not compliance checkboxes.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub