Denver Health Medical Plan Vendor Breach: 238K Members Exposed — Third-Party Risk Detection and Response Guide

Denver Health Medical Plan (DHMP) has disclosed a vendor-related data incident affecting more than 238,000 individuals, as reported by The HIPAA Journal. Once again, the breached entity is not the covered entity's own perimeter — it is a third-party vendor in the healthcare supply chain. This pattern should be familiar to every defender reading this: Change Healthcare, MOVEit/Cl0p's sweep through business associates, Accellion, Blackbaud. The attacker math is simple — one compromised vendor yields the protected health information (PHI) of hundreds of downstream healthcare organizations.

For CISOs and SOC teams in healthcare, the lesson is not "patch faster." The lesson is that your threat surface now includes every business associate, billing processor, collections agency, and IT service provider that touches your members' data. Under HIPAA, a breach at a business associate is your breach notification problem — DHMP is the one mailing 238,000 letters, absorbing the OCR scrutiny, and facing potential class action exposure, even though the intrusion reportedly occurred at a vendor.

This post breaks down what defenders should take from this incident: how vendor compromises typically unfold, what you can actually detect in your own environment when a vendor is the weak link, and the specific remediation and contractual controls that separate organizations that contain these events from organizations that read about themselves in the news.

Technical Analysis

What Happened

Denver Health Medical Plan — the managed care arm of Denver Health — notified over 238,000 individuals that their information was impacted by a security incident at a third-party vendor. While the truncated public summary does not name the vendor or the exact intrusion vector, the structural facts are the ones that matter for defense:

• The compromised system was not operated by DHMP. Detection and response depended on the vendor's telemetry, the vendor's IR maturity, and the vendor's willingness to notify quickly.
• The data at risk is member PHI/PII — in incidents of this type, typically names, dates of birth, Social Security numbers, health plan member IDs, and potentially clinical or claims data. This combination is high-value for identity theft and medical fraud and has a long exploitation tail.
• Regulatory exposure flows uphill. Under HIPAA's Breach Notification Rule (45 CFR §§ 164.400–414), business associates must notify covered entities of breaches, and the covered entity bears the obligation to notify individuals, HHS, and (for 500+ record breaches) the media. At 238K affected, this lands on the OCR breach portal and triggers mandatory regulatory review.

How Vendor Compromises Typically Unfold

In the healthcare vendor breaches I have led IR engagements on over the past five years, the attack chain almost always follows one of three patterns:

1. Internet-facing application exploitation at the vendor — an unpatched file transfer appliance, CMS, or remote access gateway. The 2023 MOVEit (CVE-2023-34362) campaign remains the canonical example, and mass-exploitation of edge devices has continued unabated through 2025–2026 across multiple vendor platforms.
2. Credential-based intrusion into vendor remote access — phishing or infostealer-harvested credentials used against VPN, RDP, or SaaS tenants lacking phishing-resistant MFA.
3. Ransomware/double-extortion operators who exfiltrate data before encryption and use the covered entities downstream as leverage against the vendor.

The critical defender insight: you cannot prevent the vendor's compromise, but you can detect its blast radius reaching your environment and limit the data the vendor holds in the first place.

Exploitation Status

No CVE is associated with this disclosure, and no specific threat actor has been publicly attributed in the available reporting. The incident is a confirmed data breach with regulatory notification underway — not a theoretical exposure. Defenders should treat this as an actively relevant supply-chain intrusion pattern, not a one-off.

Detection & Response

When the intrusion happens at a vendor, your detection surface is the interface between your organization and that vendor: SFTP transfers, API calls, vendor VPN accounts, shared SaaS tenants, and email. The following detections target the observable behaviors that matter — anomalous vendor account activity, bulk data staging and egress, and credential abuse of third-party accounts.

Sigma Rules

The rules below focus on two high-fidelity behaviors: vendor/service accounts accessing systems outside their historical baseline, and bulk data staging consistent with pre-exfiltration behavior on file transfer infrastructure.

---
title: Vendor Service Account Logon from Unusual Source
description: Detects third-party/vendor named accounts authenticating from new hosts or at unusual volume, a common indicator when a vendor-side compromise pivots into the covered entity via legitimate credentials.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1199/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 3f9c1a2e-7b4d-4e8f-9a21-5c6d7e8f9012
tags:
  - attack.initial_access
  - attack.t1199
  - attack.t1078
logsource:
  product: windows
  category: authentication
detection:
  selection_vendor_account:
    UserName|contains:
      - 'vendor_'
      - 'svc_sftp'
      - 'svc_vendor'
      - '_ext'
  selection_new_source:
    WorkstationName|contains:
      - 'UNKNOWN'
    IpAddress|startswith:
      - '10.99.'
  condition: selection_vendor_account and selection_new_source
falsepositives:
  - Vendor staff working from new office locations or VPN egress changes
  - Tune the vendor account naming patterns and known egress ranges to your environment before enabling
level: high
---
title: Bulk Archive Creation on File Transfer or PHI-Adjacent Servers
description: Detects mass compression/archiving activity by non-administrator processes on servers designated for file transfer or data exchange, consistent with staging PHI for exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 8b2e4d6a-1c3f-4a5b-b7d9-2e4f6a8c0e1g
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_archivers:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
      - '\tar.exe'
  selection_context:
    CommandLine|contains:
      - 'a -t'
      - ' a '
      - '-mx'
      - '-p'
  filter_admins:
    User|contains:
      - 'svc_backup'
      - 'admin_deploy'
  condition: selection_archivers and selection_context and not filter_admins
falsepositives:
  - Legitimate backup and log rotation jobs - baseline scheduled archiving per host and alert on deviation
level: high

KQL — Microsoft Sentinel / Defender

This hunt looks for anomalous data egress patterns from vendor-facing infrastructure (SFTP gateways, file shares, exchange servers) — the moment a vendor compromise turns into your data leaving the building. It baselines outbound bytes per device and flags outliers, then joins process context for triage.

let lookback = 14d;
let baseline_window = 30d;
let vendor_subnets = dynamic(["10.50.0.0/16", "172.20.0.0/16"]);
let baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(baseline_window) .. ago(lookback))
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| summarize AvgDailyBytes = avg(1) by DeviceName
| project DeviceName;
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| summarize Connections = count(), DistinctDestinations = dcount(RemoteIP), Destinations = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1d)
| where DistinctDestinations > 25
| join kind=leftouter (DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("7z.exe","rar.exe","tar.exe","rclone.exe","megacmd.exe")
    | summarize ArchiveCmds = make_set(ProcessCommandLine, 10) by DeviceName
    ) on DeviceName
| project TimeGenerated, DeviceName, InitiatingProcessFileName, Connections, DistinctDestinations, Destinations, ArchiveCmds
| order by DistinctDestinations desc

For identity-side hunting, this query catches vendor-tagged accounts authenticating from sources never seen in the trailing baseline — the single highest-value signal when a vendor's credentials are in hostile hands:

let baseline = SigninLogs
| where TimeGenerated between (ago(30d) .. ago(2d))
| where UserPrincipalName has_any ("vendor", "ext#", "svc_")
| summarize KnownIPs = make_set(IPAddress), KnownApps = make_set(AppDisplayName) by UserPrincipalName;
SigninLogs
| where TimeGenerated > ago(2d)
| where UserPrincipalName has_any ("vendor", "ext#", "svc_")
| join kind=inner baseline on UserPrincipalName
| where IPAddress !in (KnownIPs)
| project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, ResultType, ResultDescription, KnownIPs
| order by TimeGenerated desc

Velociraptor VQL

If you get called in on a vendor breach and need to determine whether the covered entity's own transfer infrastructure was touched, this artifact sweeps endpoints for staging artifacts — recently created archives in data directories — and correlates with live network connections to known file-transfer tooling.

-- Hunt for recently created archives and active transfer tooling on file servers
LET archive_hits = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Data/**/*.zip','C:/Data/**/*.7z','C:/Data/**/*.rar','C:/Shares/**/*.zip','D:/SFTP/**/*.zip'])
WHERE Mtime > now() - 86400*7
ORDER BY Mtime DESC

LET connections = SELECT Pid, Name, RemoteAddr, Status
FROM netstat()
WHERE Name =~ '(?i)rclone|filezilla|winscp|megacmd|curl|wget'
  AND Status = 'ESTABLISHED'

SELECT * FROM archive_hits
UNION ALL
SELECT FullPath=NULL, Size=NULL, Mtime=NULL, Btime=NULL FROM connections

PowerShell — Vendor Account and Transfer Hardening Audit

Run this against your environment to enumerate the exact assets a vendor breach would exploit: third-party accounts, their group memberships, last logon times, and SFTP/transfer services.

# Vendor account exposure audit - run on a domain-joined admin workstation
$cutoff = (Get-Date).AddDays(-90)

# Enumerate likely vendor/external accounts and their privileges
Get-ADUser -Filter { Name -like '*vendor*' -or Name -like 'svc_*' -or Name -like '*_ext*' } -Properties LastLogonDate, MemberOf, Enabled |
  Select-Object Name, SamAccountName, Enabled, LastLogonDate,
    @{N='Groups';E={($_.MemberOf | Get-ADGroup | Select-Object -ExpandProperty Name) -join '; '}} |
  Where-Object { $_.Enabled -eq $true -and ($_.LastLogonDate -lt $cutoff -or $_.LastLogonDate -eq $null) } |
  Export-Csv -Path .\StaleVendorAccounts.csv -NoTypeInformation

# Identify transfer services that could be leveraged for egress
Get-Service -Name *ftp*, *sftp*, *ssh* -ErrorAction SilentlyContinue |
  Select-Object Name, Status, StartType | Format-Table -AutoSize

# Check for outbound transfer tooling presence on servers
Get-ChildItem -Path 'C:\Program Files','C:\Program Files (x86)' -Recurse -Include 'rclone.exe','winscp.com','psftp.exe' -ErrorAction SilentlyContinue |
  Select-Object FullName, LastWriteTime

Remediation

There is no patch for a vendor breach. Remediation is a combination of contractual enforcement, architectural data minimization, and monitoring of the seams. In priority order:

Immediate (this week):

1. Inventory every business associate and the exact data elements they hold. You cannot assess blast radius for a vendor you forgot you had. Map BAAs to actual data flows — not the contract drawer.
2. Audit and disable stale vendor accounts. The PowerShell above will surface enabled vendor accounts with no logon in 90 days. Disable them today; require re-provisioning with a business justification.
3. Enforce phishing-resistant MFA (FIDO2/passkeys) on every vendor-facing authentication path — VPN, SFTP web portals, SaaS tenants, EHR partner access. Credential theft is the dominant vendor-side intrusion vector.
4. Review egress controls on transfer infrastructure. Vendor-facing SFTP gateways and file shares should have explicit outbound allowlists. Default-deny egress would have materially complicated nearly every mass-exfiltration event I have investigated.

Short term (30–60 days): 5. Apply data minimization contractually. Amend BAAs to require vendors to retain only the minimum necessary PHI, with defined purge schedules. A vendor holding seven years of member data "just in case" is how 238K-record breaches happen. 6. Deploy the detections above. Baseline vendor account source IPs and transfer volumes now, so the deviation alert means something when it fires. 7. Tabletop the vendor breach scenario. Your IR plan must answer: Who calls whom when the vendor notifies you at hour 72 of their own investigation? Who owns OCR notification drafting? What is your 60-day HIPAA clock start date (date of discovery — which, per HHS guidance, is when you knew or should have known)?

Structural (this year): 8. Vendor security attestation with teeth. Move beyond questionnaire theater — require evidence of MFA coverage, EDR deployment, and independent assessments (SOC 2 Type II, HITRUST) for any vendor handling PHI at scale, with breach-notification SLAs of 24–48 hours written into the BAA, not the HIPAA-default "no later than 60 days." 9. Network segmentation between vendor connections and PHI stores. Vendor VPNs should terminate in a DMZ with brokered, logged, per-session access — never flat network adjacency to clinical or claims systems. 10. Credit monitoring is not remediation. For the 238,000 affected members, DHMP's notification likely includes identity protection offers. For your organization, the remediation bar is higher: demonstrate to OCR that your vendor risk management program is a living control, not a binder.

The Denver Health Medical Plan incident is the latest entry in a pattern that shows no sign of slowing in 2026: attackers have correctly identified that healthcare's softest target is its supply chain. The covered entities that weather these events are the ones that treated vendor access as hostile-adjacent before the breach letter arrived.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub