HCA Healthcare, Blossom Health, El Camino Health & UMMC Breaches: HIPAA Detection and Hardening Playbook

Four separate healthcare organizations — HCA Healthcare, Blossom Health, El Camino Health, and the University of Mississippi Medical Center — have disclosed data breaches in a single reporting cycle. When multiple covered entities announce incidents simultaneously, it's rarely coincidence. It's a reminder that healthcare remains the most targeted sector for data theft, and the most expensive: healthcare breaches have averaged over $9 million per incident in recent IBM Cost of a Data Breach reporting, more than double the cross-industry average.

The disclosed incidents follow patterns we've seen dominate the healthcare threat landscape: unauthorized access to employee email accounts containing protected health information (PHI), compromise of third-party service providers, and network intrusions that persisted long enough to expose patient records. Whether the initial vector was credential phishing, a vulnerable internet-facing service, or a business associate compromise, the defensive lessons converge on the same control gaps.

If you operate a SOC for a hospital system, ambulatory network, or health plan, this post is your playbook for the detection and hardening work that should already be underway.

Why Healthcare Keeps Bleeding

Healthcare environments have structural characteristics that attackers exploit ruthlessly:

• Identity sprawl. Thousands of clinicians, contractors, travel nurses, and vendors with mailbox and EHR access, often with weak offboarding. Dormant accounts are a persistent initial-access vector.
• Email as the dominant data store for PHI. Appointment summaries, lab results, billing records, and referral documents live in Exchange Online and Gmail mailboxes far longer than they should. Compromise one mailbox and you inherit years of PHI.
• Flat, legacy networks. Clinical devices running unsupported operating systems, VLANs that don't isolate clinical from corporate, and SMB shares mapped for convenience.
• Third-party dependency. Business associates — billing firms, transcription services, IT vendors — with BAA paperwork but inconsistent security controls. Supply-chain compromise of a single vendor exposes dozens of downstream providers.
• 24/7 operations. No maintenance windows, limited ability to isolate systems during incident response, and extreme pressure to restore service — exactly the leverage ransomware crews monetize.

Technical Analysis: The Attack Chains Behind Healthcare Breach Disclosures

While the specifics of each disclosed incident vary, the attack chains in healthcare breaches of this type typically resolve to three patterns. Defenders should hunt for all three.

Pattern 1: Credential Phishing → Mailbox Compromise → PHI Discovery

1. Targeted phishing (often MFA-fatigue or adversary-in-the-middle proxy kits) captures a staff member's Microsoft 365 credentials.
2. The attacker logs in from an anomalous geography or ASN, creates inbox rules to hide security alerts, and searches mailboxes for keywords like SSN, insurance, DOB, diagnosis, or attachment.
3. PHI is exfiltrated via auto-forwarding rules to external addresses, or bulk-exported via eDiscovery/PST export.
4. Discovery occurs weeks or months later — often only when unusual mail flow or a patient complaint surfaces.

Pattern 2: External Service Exploitation → Network Intrusion → Staging and Exfiltration

1. An internet-facing VPN appliance, remote access service, or unpatched web application provides initial access.
2. Attackers enumerate shares, dump credentials with tools like rundll32 comsvcs.dll MiniDump or procdump, and move laterally via RDP/SMB to servers hosting PHI databases or file shares.
3. Data is staged into archives (commonly via 7-Zip/WinRAR) and exfiltrated to cloud storage (MEGA, Rclone to S3/Backblaze) or over HTTPS to attacker infrastructure.
4. Depending on the actor, encryption for extortion may follow — but pure data-theft extortion without encryption is increasingly common.

Pattern 3: Business Associate / Third-Party Compromise

1. A vendor with legitimate API or VPN access to the provider's environment is breached.
2. The provider's own telemetry shows authorized credentials performing unauthorized volume and scope of access.
3. Detection depends entirely on behavioral analytics and access baselining — traditional signature controls are blind here.

Exploitation status: These are not theoretical patterns. Email account compromise and third-party breaches account for the majority of large HIPAA-reportable incidents on the HHS OCR breach portal, and healthcare data theft extortion campaigns remain among the most active operations tracked across 2025 and into 2026.

Detection & Response

The following detections target the observable behaviors common to these breach patterns. Tune thresholds to your environment's baselines before production deployment.

---
title: Suspicious Inbox Rule Created to Hide or Exfiltrate Mail
description: Detects creation of inbox rules that auto-delete, auto-forward externally, or mark security-related mail as read — a hallmark of business email compromise and mailbox-based PHI theft.
references:
  - https://attack.mitre.org/techniques/T1114/002/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 4f2c9a81-7b3e-4d21-9c58-2e6a1b7d9045
tags:
  - attack.collection
  - attack.t1114.002
  - attack.exfiltration
logsource:
  product: office365
  service: exchange
detection:
  selection_suspicious_rule:
    Operation:
      - 'New-InboxRule'
      - 'Set-InboxRule'
    Parameters|contains:
      - 'ForwardTo'
      - 'ForwardAsAttachmentTo'
      - 'RedirectTo'
      - 'DeleteMessage'
      - 'MarkAsRead'
  filter_internal:
    Parameters|contains:
      - '@yourdomain.org'
  condition: selection_suspicious_rule and not filter_internal
falsepositives:
  - Legitimate user forwarding to personal accounts (policy violation, still worth reviewing)
  - Automated service accounts creating rules
level: high
---
title: Mass Archive Creation on PHI File Shares
description: Detects compression tools (7-Zip, WinRAR) invoked with archive creation flags on servers, a common staging behavior before PHI exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 8b1d4e63-2f9a-47c5-b312-6d8e0c4a5217
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - '-mx'
      - '-v'
      - '-hp'
  condition: all of selection_*
falsepositives:
  - Legitimate backup and archiving operations by admins
  - Software packaging workflows
level: medium
---
title: Rclone or Cloud Sync Tool Execution on Clinical Servers
description: Detects execution of Rclone or similar cloud exfiltration utilities, frequently abused to move stolen PHI to attacker-controlled cloud storage.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: c7e5f2a9-4d8b-41e6-a503-9f1c2b6d3804
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\megasync.exe'
    OriginalFileName|contains:
      - 'rclone'
      - 'MEGAcmd'
falsepositives:
  - Sanctioned cloud backup tooling (whitelist approved paths and hashes)
level: high

// Hunt: Anomalous M365 sign-ins followed by mailbox rule creation or mail flow anomalies
// Surfaces the credential phishing -> mailbox compromise -> PHI theft chain
let Lookback = 14d;
let SuspiciousSignins =
    SigninLogs
    | where TimeGenerated > ago(Lookback)
    | where ResultType == 0
    | where Location !in (dynamic(["US"])) or RiskLevelDuringSignIn in ("high", "medium")
    | summarize FirstSignin = min(TimeGenerated),
                Locations = make_set(Location),
                IPs = make_set(IPAddress)
        by UserPrincipalName, AppDisplayName;
OfficeActivity
| where TimeGenerated > ago(Lookback)
| where OfficeWorkload == "Exchange"
| where Operation in~ ("New-InboxRule", "Set-InboxRule", "Set-Mailbox", "New-InboundConnector")
| where Parameters has_any ("ForwardTo", "RedirectTo", "ForwardingSmtpAddress", "DeleteMessage")
| project TimeGenerated, UserId = UserId, Operation, Parameters, ClientIP
| join kind=inner (SuspiciousSignins) on $left.UserId == $right.UserPrincipalName
| project RuleCreated = TimeGenerated, UserId, Operation, Parameters, ClientIP, Locations, IPs
| order by RuleCreated desc;

// Hunt: Unusual outbound data volume from servers (exfil staging indicator)
// Requires Syslog/CEF ingestion of firewall or proxy logs into CommonSecurityLog
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceDirection == 0 or DeviceAction =~ "allowed"
| summarize TotalBytesOut = sum(tolong(SentBytes)),
            UniqueDestinations = dcount(DestinationIP),
            Destinations = make_set(DestinationIP, 20)
    by SourceIP, SourceHostName
| where TotalBytesOut > 5000000000   // >5 GB outbound in 7 days; tune to baseline
| order by TotalBytesOut desc;

-- Hunt for exfiltration tooling and archive staging on Windows endpoints
-- Deploy as a Velociraptor hunt across servers hosting PHI shares
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       hash(path=Exe).SHA256 AS ExeHash
FROM pslist()
WHERE Name =~ '(?i)(rclone|megacmd|megasync|7z|7za|rar|winrar|procdump)'
   OR CommandLine =~ '(?i)(comsvcs\.dll.*MiniDump| copy | -v[0-9]+[mkg] )'
ORDER BY CreateTime DESC

# Hardening & audit script: mailbox forwarding, dormant accounts, and risky sharing on M365/AD
# Run from a workstation with ExchangeOnlineManagement and Microsoft.Graph modules installed

# 1. Find all mailboxes with external forwarding configured (classic BEC/PHI theft indicator)
Connect-ExchangeOnline
Get-Mailbox -ResultSize Unlimited |
  Where-Object { $_.ForwardingSmtpAddress -ne $null -or $_.ForwardingAddress -ne $null } |
  Select-Object DisplayName, PrimarySmtpAddress, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward |
  Export-Csv -Path .\ExternalForwardingAudit.csv -NoTypeInformation

# 2. Find inbox rules that forward or redirect externally (user-level, hidden from admin center defaults)
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
  Get-InboxRule -Mailbox $_.UserPrincipalName -ErrorAction SilentlyContinue |
    Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo } |
    Select-Object @{N='Mailbox';E={$_.MailboxOwnerId}}, Name, ForwardTo, RedirectTo, ForwardAsAttachmentTo
} | Export-Csv -Path .\InboxRuleForwardingAudit.csv -NoTypeInformation

# 3. Identify dormant AD accounts still enabled (prime initial-access targets in healthcare)
$Cutoff = (Get-Date).AddDays(-90)
Get-ADUser -Filter { Enabled -eq $true } -Properties LastLogonDate |
  Where-Object { $_.LastLogonDate -lt $Cutoff -or $_.LastLogonDate -eq $null } |
  Select-Object SamAccountName, Enabled, LastLogonDate, DistinguishedName |
  Export-Csv -Path .\DormantAccountsAudit.csv -NoTypeInformation

# 4. Verify unified audit log is enabled (mandatory for investigating mailbox breaches)
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled

# 5. Export suspicious sign-in risk events from the last 30 days for IR triage
Connect-MgGraph -Scopes "IdentityRiskEvent.Read.All"
Get-MgRiskDetection -Filter "riskState eq 'atRisk'" -All |
  Select-Object UserPrincipalName, RiskType, RiskLevel, DetectedDateTime, IpAddress, Location |
  Export-Csv -Path .\RiskySignins30d.csv -NoTypeInformation

Remediation and Hardening Priorities

If you discover active compromise, contain first, then remediate. If you're hardening proactively (you should be), prioritize in this order:

1. Enforce phishing-resistant MFA. Move from SMS/push MFA to FIDO2 security keys or certificate-based auth for all users with mailbox or EHR access. Conditional Access should block legacy auth (IMAP/POP/SMTP basic auth) entirely — AiTM phishing kits bypass push MFA but not passkeys.
2. Kill external mail forwarding. Set Set-HostedOutboundSpamFilterPolicy -AutoForwardingMode Off at the tenant level and alert on any exception. Review the forwarding audit output above and remove unauthorized rules.
3. Deprovision dormant accounts. Automate a 60–90 day inactivity disable policy with HR-driven recertification for travel/contract clinical staff. This is the single highest-ROI account hygiene control in healthcare.
4. Segment clinical from corporate. PHI databases, imaging systems (PACS), and EHR application tiers should sit behind enforced segmentation with deny-by-default east-west rules. Ransomware that reaches a flat network reaches patient care.
5. Baseline and alert on data egress. Establish per-host outbound byte baselines; alert on >5 GB/day deviations from servers that don't normally back up offsite. Block unsanctioned cloud storage domains (MEGA, etc.) at the proxy.
6. Audit business associate access. Inventory every vendor with VPN, API, or EHR integration access. Apply least privilege, short-lived credentials, and log every third-party session with the same scrutiny as internal admin activity.
7. Confirm your audit trail before you need it. Unified Audit Log retention, EHR audit logs, and firewall logs must cover at least 12 months — OCR investigations and breach notifications routinely require reconstructing access months in the past.
8. Exercise the breach clock. HIPAA's Breach Notification Rule (45 CFR §§ 164.400–414) requires notification to affected individuals within 60 days of discovery, and to HHS (and media, for 500+ record breaches). Your IR retainer, forensics vendor, legal counsel, and notification workflows should be tested via tabletop exercise, not discovered during a live incident.

For incidents already in flight: preserve mailbox audit logs and sign-in logs immediately (they age out), force enterprise-wide credential resets with token revocation (Revoke-AzureADUserAllRefreshToken / Revoke-MgUserSignInSession), and engage counsel early — breach determination under HIPAA is a legal analysis, not just a technical one.

The Bottom Line

Four breach announcements in one cycle is not a statistical anomaly — it's the steady state of healthcare security in 2026. The organizations that avoid becoming the next disclosure are the ones that treat mailbox compromise, third-party access, and egress monitoring as front-line detection problems rather than compliance checkboxes. Run the hunts above this week. If they're quiet, you've validated your baselines. If they're not, you've found your incident before OCR does.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub