Defending Against Unauthorized PHI Retention: Lessons from Recent Healthcare Breaches

In our Digital Forensics and Incident Response (DFIR) practice at Security Arsenal, we often see organizations focus their defensive posture on external adversaries—ransomware gangs and nation-state actors. However, the recent announcements from Women’s Wellness of Southern Delaware and a Florida-based women’s health provider serve as a stark reminder that some of the most damaging exposures stem from internal data governance failures and unauthorized retention.

These incidents involve the unauthorized retention of sensitive Protected Health Information (PHI). While these specific disclosures did not originate from a zero-day exploit or a sophisticated supply-chain attack, the impact on the affected patients is identical: identity theft risk, privacy violation, and potential medical fraud. For defenders in the healthcare sector, this is a wake-up call to audit not just who accesses data, but where that data lives and how long it persists.

Technical Analysis

While no specific CVE (2025/2026) is associated with this particular failure mode, the threat vector here is Data Mismanagement and Staging. In technical terms, unauthorized retention often occurs through:

1. Shadow IT and Local Staging: Employees copying data from secure EHR (Electronic Health Record) systems to local spreadsheets, USB drives, or personal cloud storage for "convenience."
2. Backup and Archive Failures: Legacy systems or improperly configured backups retaining data indefinitely, failing to honor data retention schedules.
3. Third-Party Data Leaks: Data shared with vendors (e.g., marketing, transcription, or analytics) that is not deleted after the contract expires.

The attack surface in this scenario is the file system itself. The "exploit" is the lack of technical controls preventing mass data exfiltration or the failure to automate data lifecycle management. In many cases we investigate, we find terabytes of stale PHI sitting in unsecured file shares or employee desktop directories—ripe for picking by malware or insider threats.

Detection & Response

Detecting unauthorized retention requires shifting focus from network traffic to file system hygiene and mass data movement. We must hunt for indicators of data staging (e.g., compressing large volumes of patient data) and audit for "orphaned" data that violates retention policies.

Sigma Rules

The following Sigma rules target common behaviors associated with data staging and unauthorized access to sensitive directories.

---
title: Potential Data Staging via Mass Compression
id: 8a4d2e10-1b5f-4c9e-9a0f-2b3c4d5e6f7a
status: experimental
description: Detects the creation of compressed archives (zip, rar, 7z) in user profiles or temp directories, which may indicate PHI staging for exfiltration or unauthorized retention.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: file_creation
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\Desktop\'
      - '\Downloads\'
    TargetFilename|endswith:
      - '.zip'
      - '.rar'
      - '.7z'
  filter_legit_apps:
    Image|contains:
      - '\Windows\'
      - '\Program Files\'
  condition: selection and not filter_legit_apps
falsepositives:
  - Users legitimately backing up their own work documents
level: medium
---
title: Mass Access to Sensitive File Shares
id: 9b5e3f21-2c6g-5d0f-0b1g-3c4d5e6f7g8h
status: experimental
description: Detects a single user account accessing a high volume of distinct files within a short timeframe, typical of mass data copying or "grabbing" behavior for retention.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\PHI\'
      - '\Patients\'
      - '\MedicalRecords\'
  timeframe: 5m
  condition: selection | count() > 50
falsepositives:
  - Legitimate bulk processing by administrative staff or backup software
level: high

KQL (Microsoft Sentinel / Defender)

This query hunts for suspicious file creation patterns indicative of data dumping or staging on endpoints.

DeviceFileEvents
| where Timestamp >= ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FileName has_any (".zip", ".rar", ".7z", ".csv", ".xlsx", ".xlsm")
| where FolderPath contains "PHI" 
   or FolderPath contains "Patients" 
   or FolderPath contains "Medical"
| summarize Count = count(), FileList = make_list(FileName) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFolderPath
| where Count > 20
| order by Count desc

Velociraptor VQL

This artifact hunts for large archive files or spreadsheets that may contain aggregated PHI, often found in user directories where they shouldn't be retained long-term.

-- Hunt for potential PHI dump files in user directories
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs="/*/Users/*/*.zip")
WHERE Size > 1024 * 1024 * 10  -- Larger than 10MB
   AND Mtime < now() - duration("7d")  -- Not modified in last 7 days (stale)

UNION ALL

SELECT FullPath, Size, Mtime, Atime
FROM glob(globs="/*/Users/*/*.csv")
WHERE Size > 1024 * 1024 * 5   -- Larger than 5MB
   AND Mtime < now() - duration("30d")

Remediation Script (PowerShell)

Use this script to audit file shares for stale PHI files that may represent unauthorized retention. Note: This is a discovery script; deletion requires validation.

# Audit Script: Identify Stale Potential PHI Files
# Parameters: $RootPath (e.g., "C:\Shares" or "D:\Data")
# $DaysInactive (Files not modified in X days)

$RootPath = "C:\SharedData"
$DaysInactive = 365
$CutoffDate = (Get-Date).AddDays(-$DaysInactive)
$ReportPath = "C:\Temp\StalePHI_Report.csv"

Write-Host "Scanning $RootPath for files inactive since $CutoffDate..."

$StaleFiles = Get-ChildItem -Path $RootPath -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -lt $CutoffDate -and $
                  ($_.Extension -match '\.(csv|xls|xlsx|eml|msg|pdf|txt|doc|docx)$') }

if ($StaleFiles) {
    $StaleFiles | Select-Object FullName, LastWriteTime, Length, Extension |
        Export-Csv -Path $ReportPath -NoTypeInformation
    Write-Host "Report generated: $ReportPath"
    Write-Host "Total files found: $($StaleFiles.Count)"
} else {
    Write-Host "No stale files found matching criteria."
}

Remediation

Addressing unauthorized retention requires a blend of technical enforcement and policy revision:

1. Implement Data Loss Prevention (DLP): Configure DLP policies to detect and block the transfer of sensitive data types (e.g., Credit Card Numbers, Medical Record Numbers) to unauthorized endpoints, cloud storage, or removable media.
2. Automate Data Lifecycle Management: Do not rely on users to delete files. Use technical controls (Microsoft SharePoint auto-deletion, FSRM quotas, or archival scripts) to automatically move or delete data based on defined retention schedules.
3. Revoke Excessive Access: Perform a rigorous access review. Ensure users have "Just-in-Time" (JIT) access to sensitive file shares rather than persistent standing rights.
4. Third-Party Risk Management: If the breach involved a vendor (as is common in "unauthorized retention" cases), audit all third-party data sharing agreements. Require certificate of destruction (CoD) upon contract termination and verify it technically if possible.
5. Secure Backups: Ensure backups are immutable and encrypted. Verify that legacy backup systems (often the source of retention issues) are decommissioned or securely migrated.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub