Hawaii Family Dental has disclosed a hacking incident that affected nearly 46,000 individuals, adding to a relentless wave of breaches targeting the healthcare sector. While the public notification provides limited technical detail — no confirmed threat actor, no named initial access vector, and no CVE — the pattern is one we've worked dozens of times in incident response engagements: an unauthorized actor gains access to systems housing protected health information (PHI), dwells long enough to identify and access patient data repositories, and the organization discovers the compromise weeks or months later during forensic review.
For dental practices and mid-size healthcare organizations, this incident is a forcing function. Dental groups hold exactly what criminal actors monetize most efficiently: full identity kits (names, dates of birth, Social Security numbers, addresses, insurance details) combined with treatment records. These records fuel medical identity theft, insurance fraud, and highly targeted phishing. Because healthcare entities are HIPAA-regulated, a breach of this size also triggers mandatory HHS Office for Civil Rights (OCR) reporting, potential OCR investigation, and multi-state attorney general notification obligations.
If you operate, manage, or defend a healthcare environment — particularly a small-to-mid-size practice without a dedicated security team — this post gives you the detection logic and hardening steps that matter most right now.
Technical Analysis
What We Know
Public reporting on this incident is thin on technical specifics, which is typical for healthcare breach notifications in their early phase. What we can state with confidence:
- Affected organization: Hawaii Family Dental, a multi-location dental practice group.
- Impact: Approximately 46,000 individuals notified.
- Incident classification: Reported as a "hacking incident" — under HHS OCR breach portal taxonomy, this maps to a Hacking/IT Incident, which historically accounts for the overwhelming majority of large healthcare breaches (over 75% of reported large breaches in recent OCR data).
- Regulatory context: HIPAA Breach Notification Rule (45 CFR §§ 164.400-414) applies; notification to affected individuals and HHS is required within 60 days of discovery for breaches of 500+ individuals, plus media notification for breaches affecting 500+ residents of a state.
The Realistic Attack Chain
Because no CVE or exploit has been disclosed, defenders should model this incident against the attack chains we actually see in healthcare intrusions of this profile. Based on our IR caseload against dental and specialty medical practices, the dominant patterns are:
- Credential-based initial access — Phished or brute-forced credentials against remote access services (RDP exposed to the internet, VPN without MFA, or cloud email via business email compromise). Small practices overwhelmingly use Microsoft 365 for email and scheduling; a single phished front-desk account can pivot to shared drives containing exported patient records.
- Managed service provider or vendor compromise — Dental practices depend heavily on third-party IT and practice management software vendors. Compromise of a vendor's remote management tooling (RMM platforms like ConnectWise, Kaseya, or generic RMM agents) gives attackers legitimate-looking access that blends into normal traffic.
- Unpatched edge devices — Firewalls, VPN concentrators, and remote access appliances with known exploited vulnerabilities remain the top technical root cause in healthcare IR engagements we've led.
- Data staging and exfiltration — Once inside, actors locate the practice management database (common dental platforms store patient records in local SQL Server instances or flat-file exports), stage data into archives, and exfiltrate over HTTPS, Rclone, or MEGAsync-style cloud storage tools.
Exploitation Status
No specific vulnerability, proof-of-concept, or threat actor attribution has been published for this incident as of this writing. There is no CISA KEV entry associated with this event. Defenders should treat this as a post-compromise detection and hardening exercise, not a patch-now emergency for a specific CVE. The defensive value here is behavioral detection and architectural control, not signature-based blocking.
Detection & Response
The detections below target the behaviors that appear in virtually every healthcare intrusion of this type: unauthorized access to patient data stores, mass data staging and archive creation, and exfiltration tooling. They are tuned to fire on high-fidelity anomalies in a small healthcare environment, not to generate noise.
Sigma Rules
---
title: Mass Archive Creation in Patient Data Directories
id: 3f8a2b71-4c6d-4e9f-b1a2-9d5c7e8f0a1b
status: experimental
description: Detects creation of compressed archives within directories commonly used to store patient records or practice management database exports, a hallmark of data staging prior to exfiltration.
references:
- https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.collection
- attack.t1560.001
logsource:
category: file_event
product: windows
detection:
selection_paths:
TargetFilename|contains:
- '\patients'
- '\patient_data'
- '\dental'
- '\ehr'
- '\emr'
- '\practice'
- '\eaglesoft'
- '\dentrix'
- '\opendental'
selection_ext:
TargetFilename|endswith:
- '.zip'
- '.7z'
- '.rar'
- '.tar.gz'
condition: selection_paths and selection_ext
falsepositives:
- Scheduled backup software creating archives in these directories (whitelist the backup process Image)
- Vendor-mandated database export routines
level: high
---
title: Rclone or Cloud Sync Tool Execution on Healthcare Servers
id: 8c2e5d14-7a9b-4f3c-a6e1-2b4d6f8a0c3e
status: experimental
description: Detects execution of Rclone or similar cloud storage synchronization tools on servers hosting patient data. These tools are frequently used by intruders for bulk exfiltration to attacker-controlled cloud storage.
references:
- https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\rclone.exe'
- '\megasync.exe'
- '\megacmd.exe'
- '\googledrivesync.exe'
selection_cli:
CommandLine|contains:
- 'copy'
- 'sync'
- 'move'
- '--transfers'
condition: selection_img and selection_cli
falsepositives:
- Legitimate IT use of Rclone for offsite backup (investigate destination configuration; whitelist only after verification)
level: high
---
title: RDP Logon Followed by Database Process Access Outside Business Hours
id: b5d1f092-3e8c-4a7d-9c2f-6e1a8b0d4f7c
status: experimental
description: Detects interactive RDP-type logons to servers hosting patient databases during non-business hours, a common pattern in healthcare intrusions where actors browse for data stores after staff leave.
references:
- https://attack.mitre.org/techniques/T1078/
- https://attack.mitre.org/techniques/T1021/001/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.lateral_movement
- attack.t1021.001
- attack.t1078
logsource:
category: authentication
product: windows
detection:
selection:
LogonType:
- 10
- 7
filter_time:
TimeGenerated|hour:
- 0
- 1
- 2
- 3
- 4
- 5
- 20
- 21
- 22
- 23
filter_known:
AccountName|contains:
- 'svc_backup'
- 'itadmin'
condition: selection and filter_time and not filter_known
falsepositives:
- Legitimate after-hours maintenance by IT staff or MSP (whitelist documented maintenance accounts and windows)
level: medium
KQL Hunt Query (Microsoft Sentinel / Defender)
This query hunts for the two highest-signal behaviors in one pass: after-hours interactive logons to servers, and large outbound transfers to cloud storage domains commonly abused for exfiltration.
let BusinessHoursStart = 7;
let BusinessHoursEnd = 19;
let ExfilDomains = dynamic(["mega.nz", "mega.io", "transfer.sh", "wetransfer.com", "file.io", "anonfiles.com", "gofile.io", "pixeldrain.com"]);
let SuspiciousLogons =
SecurityEvent
| where EventID == 4624 and LogonType in (10, 7)
| extend Hour = datetime_part("hour", TimeGenerated)
| where Hour < BusinessHoursStart or Hour >= BusinessHoursEnd
| where Account !startswith "svc_" and Account !endswith "$"
| summarize AfterHoursLogons=count(), DistinctAccounts=dcount(Account), Accounts=make_set(Account) by Computer, bin(TimeGenerated, 1d)
| where AfterHoursLogons >= 3;
let CloudTransfers =
DeviceNetworkEvents
| where RemoteUrl has_any (ExfilDomains)
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), InitiatingProcesses=make_set(InitiatingProcessFileName) by DeviceName, RemoteUrl;
SuspiciousLogons
| join kind=inner (CloudTransfers | extend Computer = DeviceName) on Computer
| project Computer, TimeGenerated, AfterHoursLogons, Accounts, RemoteUrl, Connections, InitiatingProcesses, FirstSeen, LastSeen
For environments ingesting Sysmon via Sentinel, add this companion query to find mass file reads consistent with data collection against a patient records share:
Event
| where Source == "Microsoft-Windows-Sysmon" and EventID == 11
| extend EvData = parse_xml(EventData).DataItem.EventData.Data
| extend TargetFile = tostring(EvData.[4]."#text"), Image = tostring(EvData.[3]."#text")
| where TargetFile has_any ("\\patients", "\\patient_data", "\\dentrix", "\\eaglesoft", "\\opendental", "\\ehr")
| summarize FileCreates=count(), DistinctFiles=dcount(TargetFile) by Computer, Image, bin(TimeGenerated, 1h)
| where FileCreates > 100
Velociraptor VQL Hunt
Deploy this artifact across your server fleet to identify exfiltration tooling and recently created archives in patient data directories — useful even after an actor has cleaned up process telemetry:
-- Hunt for exfiltration tooling and staged archives in patient data paths
LET archive_paths = SELECT FullPath, Size, Mtime
FROM glob(globs=[
'C:/**/patient*/**/*.zip',
'C:/**/patient*/**/*.7z',
'C:/**/dental*/**/*.zip',
'C:/**/dental*/**/*.rar',
'D:/**/patient*/**/*.zip',
'D:/**/dentrix*/**/*.zip',
'D:/**/eaglesoft*/**/*.zip'
])
WHERE Mtime > now() - 86400 * 30
LET exfil_procs = SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Exe =~ '(?i)rclone|megasync|megacmd|winscp|filezilla'
OR CommandLine =~ '(?i)--transfers|mega\.nz|gofile|wetransfer'
SELECT 'staged_archive' AS FindingType, FullPath AS Artifact,
format(format='%d bytes', args=Size) AS Detail, Mtime AS EventTime
FROM archive_paths
UNION ALL
SELECT 'exfil_tool_running' AS FindingType, Exe AS Artifact,
CommandLine AS Detail, NULL AS EventTime
FROM exfil_procs
Remediation and Hardening Script
This PowerShell script performs immediate defensive actions on a Windows server hosting patient data: it audits for exposed RDP, identifies suspicious recently created archives in common patient data paths, checks for unauthorized cloud sync tooling, and verifies audit logging is enabled for the file shares that matter. Run it elevated on each server housing PHI.
# Hawaii Family Dental Breach - Defensive Verification Script
# Run elevated on servers hosting PHI. Review output before taking action.
$ReportPath = "C:\Temp\PHI_Server_Audit_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"
New-Item -Path C:\Temp -ItemType Directory -Force -ErrorAction SilentlyContinue | Out-Null
"=== PHI Server Defensive Audit - $(Get-Date) ===" | Out-File $ReportPath
# 1. Check if RDP is enabled and whether NLA is enforced
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
$nla = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
"RDP Enabled: $(if($rdp.fDenyTSConnections -eq 0){'YES - verify firewall restricts to VPN/management subnet'}else{'No'})" | Out-File $ReportPath -Append
"NLA Enforced: $(if($nla.UserAuthentication -eq 1){'Yes'}else{'NO - enable immediately'})" | Out-File $ReportPath -Append
# 2. Enumerate local admins - look for unauthorized additions
"`n=== Local Administrators ===" | Out-File $ReportPath -Append
Get-LocalGroupMember -Group 'Administrators' | Select-Object Name, PrincipalSource | Out-File $ReportPath -Append
# 3. Search common patient data paths for recently created archives (last 30 days)
"`n=== Archives Created in Last 30 Days Under Data Paths ===" | Out-File $ReportPath -Append
$paths = @('C:\Data','C:\Shares','C:\Patients','C:\Dentrix','C:\EagleSoft','C:\OpenDental','D:\')
foreach ($p in $paths) {
if (Test-Path $p) {
Get-ChildItem -Path $p -Recurse -Include *.zip,*.7z,*.rar -ErrorAction SilentlyContinue |
Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-30) } |
Select-Object FullName, CreationTime, @{N='SizeMB';E={[math]::Round($_.Length/1MB,2)}} |
Out-File $ReportPath -Append
}
}
# 4. Detect exfiltration tooling installed or present anywhere on disk
"`n=== Cloud Sync / Exfil Tooling Found ===" | Out-File $ReportPath -Append
$tools = @('rclone','megasync','megacmd','winscp','filezilla')
foreach ($t in $tools) {
$found = Get-ChildItem -Path 'C:\','D:\' -Recurse -Filter "$t*.exe" -ErrorAction SilentlyContinue -Depth 6
if ($found) { $found.FullName | Out-File $ReportPath -Append } else { "$t : not found" | Out-File $ReportPath -Append }
}
# 5. Verify Object Access auditing is enabled (required to detect PHI file access)
"`n=== Audit Policy: Object Access ===" | Out-File $ReportPath -Append
auditpol /get /subcategory:"File System" | Out-File $ReportPath -Append
# 6. Enable File System auditing if not present, and apply SACL to patient shares
auditpol /set /subcategory:"File System" /success:enable /failure:enable | Out-Null
foreach ($p in $paths) {
if (Test-Path $p) {
$acl = Get-Acl $p
$rule = New-Object System.Security.AccessControl.FileSystemAuditRule(
'Everyone','ReadData,Write,Delete','ContainerInherit,ObjectInherit','None','Success')
$acl.AddAuditRule($rule)
Set-Acl $p $acl
"SACL applied to $p" | Out-File $ReportPath -Append
}
}
"`nAudit complete. Review $ReportPath and investigate any unauthorized admins, unexpected archives, or sync tooling."
Remediation
Because no specific CVE has been disclosed in this incident, remediation centers on the controls that consistently prevent or limit healthcare intrusions of this profile:
Immediate (24-48 hours):
- Enforce MFA everywhere — Microsoft 365, VPN, RMM tooling, remote access gateways, and any vendor portals. Credential-based initial access is the dominant vector against practices of this size. MFA on email alone is not sufficient.
- Eliminate internet-exposed RDP — Confirm no server hosting PHI has RDP reachable from the internet. Place remote access behind VPN with MFA, or replace with a zero-trust brokered solution.
- Run the audit script above on every server hosting patient data. Investigate unauthorized local admins, unexpected archives, and cloud sync tooling as suspected incidents, not curiosities.
- Review RMM and vendor remote access — Inventory every remote access mechanism your IT provider and software vendors use. Require MFA, named accounts (no shared credentials), and logging forwarded to your own monitoring.
Short-term (30 days): 5. Enable Object Access auditing on all directories containing PHI, and forward logs off-box. You cannot satisfy HIPAA Security Rule audit control requirements (45 CFR § 164.312(b)) — or detect a breach in progress — without this. 6. Segment the network — Isolate imaging systems (panoramic X-ray units, CBCT scanners), practice management servers, and front-office workstations into separate VLANs. Dental imaging devices frequently run outdated, unpatchable operating systems and must never share a flat network with PHI servers. 7. Patch edge devices — Firewalls, VPN concentrators, and email gateways first. Subscribe to the CISA Known Exploited Vulnerabilities catalog and treat KEV additions affecting your edge stack as 48-hour patch emergencies. 8. Test your backups — Verify offline or immutable backups of the practice management database and document restore time. Ransomware remains a parallel risk to data theft in this sector.
Strategic (90 days): 9. Update your HIPAA Security Risk Analysis — OCR investigations after breaches of this size routinely cite stale or absent risk analyses as the basis for settlements. Document this incident as an input. 10. Deploy managed detection and response — A 46,000-record breach almost always involves dwell time measured in days to weeks. Continuous monitoring with behavioral detection (the queries above operationalized) is the difference between a contained intrusion and a notifiable breach. 11. Review breach notification readiness — Confirm your incident response plan includes OCR reporting workflows, state notification requirements, and pre-vetted external counsel and forensics retainers. The 60-day notification clock starts at discovery, not at remediation completion.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.