Connecticut Medicaid Portal Breach: HUSKY Health Compromise and Defense Guide

Hartford HealthCare recently disclosed that the personal and protected health information (PHI) of approximately 22,500 patients was exposed due to a security incident involving the Connecticut Medicaid Portal (HUSKY Health). This breach highlights the critical vulnerabilities inherent in third-party healthcare ecosystems. For defenders, this is not merely a privacy compliance issue; it is a signal that web-facing portals handling sensitive PHI are actively being targeted and compromised. The exposure of data—ranging from names and addresses to sensitive medical data—demands an immediate audit of external access points and robust implementation of threat detection on web application servers.

Technical Analysis

While specific CVEs have not been publicly disclosed in the initial breach notification, the incident involves unauthorized access to the HUSKY Health web portal, a third-party service used by Hartford HealthCare.

Affected Platform: Connecticut Medicaid Portal (HUSKY Health) / Web Application.
Attack Vector: Unauthorized access to the web portal, likely achieved via credential stuffing, session hijacking, or an unpatched web application vulnerability (e.g., IDOR or authentication bypass).
Data at Risk: Protected Health Information (PHI) including names, dates of birth, and medical treatment data.

From a defensive perspective, this pattern suggests the adversary either abused legitimate credentials or exploited a web flaw to harvest data in bulk. Defenders must assume that if perimeter web controls failed here, standard authentication logging may be insufficient. The focus must shift to detecting the behavior of data exfiltration and the persistence mechanisms often left behind on compromised web servers, such as webshells.

Detection & Response

Sigma Rules

The following rules target the common TTPs associated with web portal breaches: the execution of unauthorized commands via the web server process (Web Shell) and unusual outbound network activity from the web tier.

YAML

---
title: Web Server Process Spawning Shell
id: 8f234b1a-1c4d-4f9e-8a1b-2d3c4e5f6789
status: experimental
description: Detects the web server process spawning a shell, a common indicator of web shell activity or exploitation.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2024/05/21
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Authorized administrative debugging
level: critical
---
title: Web Server Outbound Network Connection
id: 9a345c2b-2d5e-5g0f-9b2c-3e4d5f6g7890
status: experimental
description: Detects the web server process initiating outbound connections, potentially indicating C2 beaconing or data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2024/05/21
tags:
  - attack.exfiltration
  - attack.c2
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Image|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
  condition: selection
falsepositives:
  - Legitimate API calls or updates
level: high

KQL (Microsoft Sentinel)

This hunt query identifies suspicious sign-in patterns targeting the Medicaid portal or similar healthcare applications, specifically looking for successful access following multiple failures, which is indicative of credential stuffing.

KQL — Microsoft Sentinel / Defender

SigninLogs
| where AppDisplayName contains "Medicaid" or AppDisplayName contains "HUSKY"
| project TimeGenerated, UserPrincipalName, AppDisplayName, StatusCode, ConditionalAccessStatus, DeviceDetail, Location
| summarize FailedAttempts = countif(StatusCode == "50126" or StatusCode == "50053"),
            SuccessAttempts = countif(StatusCode =~ "0") by bin(TimeGenerated, 5m), UserPrincipalName, IPAddress = DeviceDetail.ipAddress
| where FailedAttempts > 5 and SuccessAttempts > 0
| extend Timestamp = TimeGenerated
| order by Timestamp desc

Velociraptor VQL

This artifact hunts for processes that are children of common web servers, aiming to detect web shells or persistent access mechanisms left on the endpoint hosting the portal.

VQL — Velociraptor

-- Hunt for web shells by finding shell processes spawned by web servers
SELECT Parent.Name AS ParentProcess, Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Parent.Name =~ 'w3wp.exe'
   OR Parent.Name =~ 'httpd.exe'
   OR Parent.Name =~ 'nginx.exe'
   AND Name =~ 'cmd.exe'
   OR Name =~ 'powershell.exe'
   OR Name =~ 'bash'

Remediation Script (PowerShell)

This PowerShell script assists in the immediate triage of an IIS server by checking for recent file modifications in the web root—a common sign of a web shell upload—and identifying unusual processes spawned by the application pool identity.

PowerShell

# Audit IIS Web Root for recent modifications (Potential Web Shells)
$WebRoot = "C:\inetpub\wwwroot"
$TimeThreshold = (Get-Date).AddDays(-7)

Write-Host "[+] Checking for files modified in the last 7 days in $WebRoot..."
Get-ChildItem -Path $WebRoot -Recurse -File | 
Where-Object { $_.LastWriteTime -gt $TimeThreshold } | 
Select-Object FullName, LastWriteTime, Length | 
Format-Table -AutoSize

# Check for w3wp.exe spawning suspicious processes
Write-Host "[+] Checking for processes spawned by w3wp.exe..."
Get-WmiObject Win32_Process | Where-Object { 
    $_.ParentProcessId -ne 0 -and 
    (Get-Process -Id $_.ParentProcessId -ErrorAction SilentlyContinue).ProcessName -eq 'w3wp' 
} | Select-Object Name, ProcessId, ParentProcessId, CommandLine | Format-Table -AutoSize

Remediation

Identity Verification: Immediate reset of passwords for all users with access to the HUSKY Health portal. Enforce Multi-Factor Authentication (MFA) for all external portal logins.
Vendor Risk Assessment: Request a detailed incident report from HUSKY Health/Connecticut Medicaid. Demand clarity on the initial access vector—was it a vulnerability (CVE) or credential theft?
Web Application Firewall (WAF): Update WAF rules to block known scanning patterns and enforce strict rate limiting on portal login pages to thwart brute force attacks.
Log Retention & Review: Ensure all IIS/Portal logs are centralized for at least 90 days. Specifically review logs around the time of the breach for anomalous 200 OK responses to patient data endpoints by single IPs.
Patient Notification: Comply with HIPAA Breach Notification Rule requirements. Ensure credit monitoring services are offered to the 22,500 affected individuals.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub