Healthcare Data Breaches at Gastroenterology & Hepatology of Central NY, Three Oaks Hospice, and Doctor's Choice Home Health: Detection and Response Playbook

Gastroenterology & Hepatology of Central New York, Three Oaks Hospice, and Doctor's Choice Home Health have each announced data breaches, as reported by The HIPAA Journal. While each organization's notification letter will differ in the specifics — intrusion vectors, dwell time, and record counts — the pattern is one I have seen in dozens of healthcare IR engagements: small and mid-sized providers with limited security staffing, high-value protected health information (PHI) concentrated in flat networks, and attackers who know exactly that.

Why should defenders outside these three organizations care? Because healthcare breach disclosures are lagging indicators. By the time a notification letter goes out, the intrusion is often weeks or months old — and the same threat actors, initial access brokers, and ransomware affiliates who hit these providers are actively working the same playbook against hundreds of similar targets right now. Hospice and home health organizations are particularly attractive: they run lean IT operations, depend heavily on third-party billing and EHR platforms, and maintain large volumes of identity-rich data on elderly patients — premium material for identity theft and Medicare fraud.

This post breaks down what these incidents tell us about the current healthcare threat landscape and gives your SOC concrete detection logic to catch the behaviors that almost always precede these disclosures: unauthorized access to PHI stores, data staging and archiving, and exfiltration.

Technical Analysis: What These Breaches Typically Look Like From the Inside

No CVE has been publicly tied to these specific incidents at the time of writing, and breach notification letters rarely disclose the precise intrusion vector early on. But across healthcare breach investigations I've led in the past 24 months, the attack chains behind disclosures like these cluster into a small number of repeatable patterns:

1. Compromised credentials against internet-facing services. VPN portals, remote desktop gateways, OWA/M365 tenants without enforced MFA, and third-party remote support tools remain the dominant initial access vector for small healthcare providers. Attackers authenticate with credentials purchased from infostealer logs or harvested via phishing, then move directly to file shares and EHR databases.

2. Business email compromise leading to mailbox-dwelling PHI discovery. Hospice and home health staff routinely exchange patient rosters, referral documentation, and billing data over email. A single compromised mailbox can expose thousands of patient records without the attacker ever touching the file server — which is why many healthcare breach notifications describe "unauthorized access to an email account."

3. Data staging and exfiltration before extortion. In the ransomware-adjacent cases, the behavioral sequence is consistent: mass read access to shares containing PHI, archive creation (7-Zip, WinRAR, or built-in makecab/tar), staging into a single directory, then exfiltration over HTTPS to cloud storage (MEGA, Dropbox, file.io) or attacker-controlled VPS infrastructure via tools like Rclone or FileZilla.

Exploitation status: These are confirmed, real-world breaches — notifications have been issued, which under HIPAA means the organizations determined that unsecured PHI was likely accessed or acquired. The techniques behind them are neither novel nor theoretical; they are the bread and butter of current healthcare-targeting intrusion sets.

The defensive lesson: you cannot wait for a CVE to patch. The majority of healthcare breaches I investigate never involve one. They involve identity, misconfiguration, and detection gaps.

Detection & Response

The detections below target the behavioral patterns most commonly present in healthcare PHI breaches: bulk access to sensitive file stores, archive creation and staging, exfiltration tooling, and mailbox-level collection. Tune the paths and thresholds to your environment before deploying to production — a hospice's billing share and a hospital's EHR export directory will look different, but the behaviors are the same.

Sigma Rules

---
title: Mass PHI File Access on Healthcare File Shares
id: 3f8a2c91-7b4d-4e5a-9c16-2d8e5f7a1b34
status: experimental
description: Detects a single account accessing an abnormally large volume of files in directories containing PHI, patient records, billing data, or clinical documentation within a short window. Common precursor to healthcare data theft and ransomware staging.
references:
  - https://attack.mitre.org/techniques/T1213/
  - https://attack.mitre.org/techniques/T1039/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1213
  - attack.t1039
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\patient'
      - '\patients'
      - '\phi'
      - '\medical_records'
      - '\billing'
      - '\clinical'
      - '\referrals'
      - '\ehr'
      - '\emr'
  selection_extensions:
    TargetFilename|endswith:
      - '.pdf'
      - '.docx'
      - '.xlsx'
      - '.csv'
      - '.dcm'
  condition: selection_paths and selection_extensions
falsepositives:
  - EHR application service accounts performing legitimate bulk operations
  - Scheduled backup and DLP scanning jobs — exclude known service accounts
level: medium
---
title: Archive Creation Staging for Data Exfiltration
id: 8b4e1d72-5c3a-4f89-a721-9e6c3b2d4f58
status: experimental
description: Detects execution of archiving utilities with command-line patterns consistent with compressing data directories for exfiltration, a standard behavior in healthcare data theft and ransomware intrusions.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
      - '\makecab.exe'
  selection_args:
    CommandLine|contains:
      - ' a '
      - ' -r'
      - 'a -tzip'
      - 'a -t7z'
  condition: selection_tools and selection_args
falsepositives:
  - IT administrators packaging logs or software distributions
  - Legitimate backup software invoking 7-Zip — baseline known backup process trees
level: high
---
title: Exfiltration Tool Execution - Rclone or Cloud Sync Utilities
id: c7d2f948-1a6b-4e35-b842-5f9a8d3e7c61
status: experimental
description: Detects execution of Rclone or renamed copies, a tool repeatedly observed in healthcare intrusions for exfiltrating staged PHI to attacker-controlled cloud storage.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith: '\rclone.exe'
  selection_cmd:
    CommandLine|contains:
      - 'rclone'
      - ' copy '
      - ' sync '
      - ' move '
      - '--config'
      - 'mega'
      - 'dropbox'
      - 's3:'
  condition: selection_name or selection_cmd
falsepositives:
  - Rare legitimate use of Rclone for cloud backups — approve specific service accounts and paths only
level: high

KQL — Microsoft Sentinel / Defender

This query hunts for endpoints exhibiting the classic staging-then-exfil pattern: archive utility execution followed by large outbound transfers, plus inbox rule manipulation commonly seen in the email-compromise variant of these breaches.

// Hunt: archive creation + large egress + suspicious inbox rules (healthcare PHI breach TTPs)
let lookback = 14d;
let archiving =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe", "rclone.exe")
       or ProcessCommandLine has_any ("rclone", "a -t7z", "a -tzip")
    | summarize ArchiveCmds = make_set(ProcessCommandLine, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
      by DeviceName, InitiatingProcessAccountName;
let egress =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl has_any ("mega.nz", "dropbox.com", "file.io", "transfer.sh", "anonfiles", "gofile.io")
    | summarize TargetHosts = make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessAccountName;
archiving
| join kind=inner egress on DeviceName
| project DeviceName, InitiatingProcessAccountName, FirstSeen, LastSeen, ArchiveCmds, TargetHosts
| order by FirstSeen asc;
// Separately: hunt for malicious mailbox forwarding rules in M365 (BEC-style PHI collection)
CloudAppEvents
| where TimeGenerated > ago(lookback)
| where ActionType in~ ("New-InboxRule", "Set-InboxRule", "New-TransportRule")
| where RawEventData has_any ("ForwardTo", "RedirectTo", "ForwardAsAttachmentTo")
| where RawEventData !has "@yourdomain.org"  // replace with your tenant domain
| project TimeGenerated, AccountDisplayName, IPAddress, ActionType, RawEventData
| order by TimeGenerated desc;

Velociraptor VQL

Use this artifact to sweep endpoints for staging directories, recently created archives in user-writable paths, and exfiltration tooling — the forensic residue that survives long after the attacker deletes their tools.

-- Hunt for data staging artifacts and exfiltration tooling on healthcare endpoints
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Users/*/Downloads/*.zip',
  'C:/Users/*/Downloads/*.7z',
  'C:/Users/*/Downloads/*.rar',
  'C:/ProgramData/**/*.zip',
  'C:/ProgramData/**/*.7z',
  'C:/Windows/Temp/**/*.7z',
  'C:/Windows/Temp/**/*.rar'
])
WHERE Mtime > now() - 1209600  -- last 14 days
  AND Size > 10000000          -- archives >10MB warrant review
UNION
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/**/rclone.exe', 'C:/**/rclone.conf'])
UNION
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/*/stag*/*', 'C:/Users/*/*/exfil*/*'])

Remediation & Hardening Script

Run this on your M365 tenant and file servers as a rapid post-incident (or preemptive) hygiene check. It surfaces the two most common persistence/collection mechanisms we find in healthcare breach investigations: malicious inbox forwarding rules and stale external sharing.

# Healthcare PHI Breach Hygiene Audit - Security Arsenal
# Prereq: Connect-ExchangeOnline and Connect-MgGraph with appropriate scopes

# 1. Find inbox rules forwarding mail externally (BEC / PHI collection indicator)
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
    Get-InboxRule -Mailbox $_.PrimarySmtpAddress -ErrorAction SilentlyContinue |
        Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo }
} | Select-Object MailboxOwnerId, Name, ForwardTo, RedirectTo, ForwardAsAttachmentTo |
  Export-Csv .\Audit-ExternalForwardingRules.csv -NoTypeInformation

# 2. Identify mailboxes with no MFA-enforced sign-in risk (review with CA policies)
Get-MgUser -All -Property DisplayName,UserPrincipalName,AccountEnabled |
    Where-Object { $_.AccountEnabled -eq $true } |
    Select-Object DisplayName, UserPrincipalName |
    Export-Csv .\Audit-EnabledAccounts.csv -NoTypeInformation

# 3. On file servers hosting PHI: enumerate shares with broad 'Everyone' access
Get-SmbShare | ForEach-Object {
    $share = $_
    Get-SmbShareAccess -Name $share.Name |
        Where-Object { $_.AccountName -match 'Everyone|Authenticated Users|Domain Users' -and $_.AccessRight -eq 'Full' }
} | Select-Object Name, AccountName, AccessControlType, AccessRight |
  Export-Csv .\Audit-OverPermissiveShares.csv -NoTypeInformation

# 4. Find local admin accounts created in the last 30 days (unauthorized persistence check)
Get-LocalUser | Where-Object { $_.Enabled -eq $true } | ForEach-Object {
    $u = $_
    Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
        Where-Object { $_.Name -like "*$($u.Name)" } |
        ForEach-Object { [PSCustomObject]@{ Account = $u.Name; Created = $u.PasswordLastSet } }
} | Sort-Object Created -Descending

Write-Host "Review CSVs: unexpected forwarding rules, over-permissive PHI shares, and new admin accounts are your priority findings." -ForegroundColor Yellow

Remediation: What Healthcare Organizations Should Do Now

Whether or not your organization is one of the three named in these disclosures, treat this as a forcing function:

1. Enforce phishing-resistant MFA everywhere PHI lives. M365, VPN, EHR remote access, and third-party billing portals. Credential-only access to email remains the single most common root cause in healthcare breach notifications. If your MFA rollout has exceptions for clinical staff, close them — attackers know about those exceptions too.

2. Audit mailbox rules and external sharing today. Run the script above. In hospice and home health environments, we routinely find forwarding rules that survived months after the initial compromise because nobody looked.

3. Segment and permission your PHI stores. Billing shares, scanned referral documents, and EHR export directories should not be readable by every authenticated user. Apply least privilege, enable detailed file-access auditing on those paths, and alert on bulk-read behavior — that's your earliest warning of collection.

4. Baseline your egress. Hospice and small practice networks should have a short, explicit list of approved cloud destinations. Alert on anything else — Rclone to MEGA is never legitimate in a clinical environment.

5. Verify your HIPAA breach response readiness. Confirm you can answer, within hours not weeks: which systems were touched, which accounts were used, what data was accessed, and whether your forensics retention (log retention, mailbox audit logging — note Purview audit is not on by default in all SKUs) is sufficient to support a breach determination. OCR expects documented risk analysis and incident response procedures; a breach notification is the worst time to discover your logs rolled over after 30 days.

6. Review third-party exposure. Many healthcare breaches originate at billing vendors, transcription services, or IT MSPs. Inventory which business associates hold your PHI and confirm your BAAs include breach notification timelines.

7. Watch for follow-on fraud. Patients of the affected organizations should be advised of identity theft and Medicare fraud risk; organizationally, expect targeted phishing leveraging stolen patient context.

These incidents follow the same contours as the steady drumbeat of healthcare breaches reported to HHS OCR every month. The attackers aren't innovating — they're repeating what works against under-resourced defenders. The detections above target exactly those repeated behaviors. Deploy them, tune them, and don't wait for your organization's name to appear in a notification headline.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub