Settlements have received preliminary court approval to resolve class action lawsuits against Highland Health Systems (an Alabama-based behavioral health provider) and Albany Gastroenterology Consultants (a New York specialty practice) following data breaches that exposed protected health information (PHI). These cases are not isolated incidents — they are part of a sustained pattern in which healthcare organizations suffer intrusions involving unauthorized access to patient records, fail to detect the activity for weeks or months, and then face the triple penalty of OCR/HHS enforcement, class action litigation, and long-tail reputational damage.
From a defender's perspective, the specifics of the settlements matter less than the underlying failure mode: attackers (or in some cases, unauthorized insiders) gained access to large volumes of PHI and moved it out of the environment undetected. Healthcare remains the most-breached sector by cost per record for over a decade running, and the legal exposure is now routinely measured in the tens of millions. Every SOC supporting a covered entity or business associate should treat this news as a forcing function to answer one question: would we catch a bulk PHI access or exfiltration event today?
This post breaks down the attack patterns behind typical healthcare breaches of this kind and gives you concrete detection logic, hunt queries, and hardening steps you can deploy this week.
Technical Analysis
Affected Organizations and Context
- Highland Health Systems — behavioral health provider based in Alabama; the breach involved unauthorized access to systems containing patient data including names, Social Security numbers, and clinical information.
- Albany Gastroenterology Consultants — New York-based gastroenterology practice; breach exposed patient records held in practice-managed systems.
Both incidents follow the dominant healthcare breach archetype: an attacker gains initial access (phished credentials, exposed remote access, or a compromised third party), dwells in the environment, locates the systems storing PHI (EHR databases, file shares, billing systems, imaging archives), stages the data, and exfiltrates it — often to cloud storage or over encrypted channels that blend with normal traffic.
How These Attacks Typically Work (Defender's View)
No CVE was disclosed in connection with these settlements, and none should be assumed. The exploitation requirement in most healthcare breaches of this class is not a software vulnerability — it is credential theft and misconfiguration:
- Initial access — spearphishing against clinical/administrative staff, or brute-force/password-spray against exposed RDP, VPN, or webmail.
- Discovery — attackers enumerate file shares and database servers looking for EHR exports, backup repositories, scanned document stores, and billing data.
- Collection — bulk reads against PHI repositories; use of native tools like
sqlcmd,mysqldump,pg_dump,robocopy, or 7-Zip/RAR to stage archives in temp directories. - Exfiltration — transfers to attacker-controlled cloud storage (MEGA, Dropbox, file.io), or direct FTP/SFTP/HTTPS egress from database or file servers that normally never initiate outbound connections.
- Impact — frequently followed by extortion or ransomware detonation, but in many PHI-theft cases the only "impact" is silent data theft discovered months later via third-party notification.
The common thread in post-incident forensics: the data movement was observable — the organization simply wasn't watching the right telemetry. Database servers initiating outbound connections, service accounts running interactive shells, archive utilities touching patient-record directories, and gigabyte-scale egress are all high-fidelity signals.
Exploitation Status
This is not a vulnerability-disclosure event; there is no CVE, no KEV entry, and no single patch to apply. The threat is actively occurring across the healthcare sector — OCR breach reports consistently show hacking/IT incidents as the leading cause of large PHI breaches. Treat the detection guidance below as coverage for the live, ongoing threat pattern, not a historical curiosity.
Detection & Response
The rules below target the observable behaviors common to healthcare PHI-theft incidents: database dump utilities on servers, archive staging of patient directories, and anomalous outbound transfers from data-bearing hosts. Tune host/group scoping to your actual EHR, database, and file-server inventory before deployment.
---
title: Database Dump Utility Execution on Healthcare Servers
id: 8c4b2e91-3d6a-4f17-b2e9-5a1c7d8e9f01
status: experimental
description: Detects execution of native database dump/export utilities commonly abused to stage bulk PHI for exfiltration from EHR and billing databases.
references:
- https://attack.mitre.org/techniques/T1213/
- https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.collection
- attack.t1213
- attack.t1005
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\sqlcmd.exe'
- '\mysqldump.exe'
- '\pg_dump.exe'
- '\exp.exe'
- '\bcp.exe'
filter_admins:
User|startswith: 'SVC_BKP'
condition: selection_img and not filter_admins
falsepositives:
- Scheduled backup jobs run by dedicated backup service accounts — whitelist by account and parent process
- DBA maintenance windows
level: high
---
title: Archive Utility Staging Files in Temporary Directories
id: 2f7a9c34-8b1d-4e56-a3c8-6d9e2f4a7b12
status: experimental
description: Detects compression utilities staging archives into temp/staging paths, a hallmark of bulk PHI collection before exfiltration.
references:
- https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\7z.exe'
- '\7za.exe'
- '\rar.exe'
- '\winrar.exe'
selection_path:
CommandLine|contains:
- '\Temp\'
- '\tmp\'
- '\ProgramData\'
- 'AppData\Local\Temp'
condition: all of selection_*
falsepositives:
- Software packaging/deployment tooling — scope to servers hosting PHI shares and alert on interactive sessions
level: medium
---
title: Outbound Network Connection from Database Server Process
id: 5e1d8a47-2c9f-4b63-d7a4-8f3c1e6b9d05
status: experimental
description: Detects database engine processes initiating outbound connections to non-standard ports or rare destinations — strong indicator of direct exfiltration or C2 from a data-bearing host.
references:
- https://attack.mitre.org/techniques/T1041/
- https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.exfiltration
- attack.t1041
- attack.t1567
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- '\sqlservr.exe'
- '\mysqld.exe'
- '\postgres.exe'
- '\oracle.exe'
Initiated: 'true'
filter_internal:
DestinationIp|startswith:
- '10.'
- '192.168.'
- '172.16.'
condition: selection and not filter_internal
falsepositives:
- Legitimate replication, licensing, or vendor telemetry endpoints — build a per-server destination baseline and alert on first-seen destinations
level: high
// Hunt: Anomalous outbound data volume from servers hosting PHI databases or shares
// Requires DeviceNetworkEvents (MDE) or CEF/Syslog firewall ingestion into Sentinel
let PhiServers = dynamic(["ehr-db-01", "fileshare-phi-01", "billing-sql-01"]); // replace with CMDB inventory of PHI-bearing hosts
let Baseline =
DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(1d))
| where DeviceName has_any (PhiServers)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| summarize AvgDailyBytes = avg(tolong(0)), Destinations = dcount(RemoteIP) by DeviceName, RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where DeviceName has_any (PhiServers)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| summarize Connections = count(), Processes = make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteIP, RemotePort
| where RemoteIP !in (Baseline | project RemoteIP) // first-seen public destination for this server
| project TimeGenerated = now(), DeviceName, RemoteIP, RemotePort, Connections, Processes
| order by Connections desc;
-- Hunt for database dump tools and staged archives on PHI-bearing endpoints
-- Deploy scoped to EHR/database/file-server collections in Velociraptor
-- 1) Suspicious staging processes currently running or recently executed
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(mysqldump|pg_dump|sqlcmd|bcp|7z|7za|rar\.exe)'
OR Exe =~ '(?i)(7z|7za|rar)\.exe$'
-- 2) Large recently-created archives in staging/temp locations
SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Windows/Temp/*.zip', 'C:/Windows/Temp/*.7z', 'C:/Windows/Temp/*.rar',
'C:/ProgramData/**/*.7z', 'C:/ProgramData/**/*.rar',
'C:/Users/*/AppData/Local/Temp/*.7z'])
WHERE Size > 10485760 -- >10 MB staged archives
ORDER BY Mtime DESC
# Healthcare PHI exfiltration readiness audit + hardening script
# Run elevated on file/database servers hosting PHI. Review before production use.
# 1) Enable detailed file-access auditing on PHI shares (Object Access > File System)
$phiPaths = @("D:\PatientData", "E:\EHRExports") # adjust to your environment
foreach ($p in $phiPaths) {
if (Test-Path $p) {
$acl = Get-Acl $p -Audit
$auditRule = New-Object System.Security.AccessControl.FileSystemAuditRule(
"Everyone","ReadData,WriteData,Delete","ContainerInherit,ObjectInherit","None","Success")
$acl.AddAuditRule($auditRule)
Set-Acl $p $acl
Write-Output "[+] Audit policy applied to $p"
}
}
auditpol /set /subcategory:"File System" /success:enable /failure:enable
# 2) Verify outbound filtering: database servers should not egress to the internet
Get-NetFirewallProfile | Select-Object Name, DefaultOutboundAction | Format-Table
New-NetFirewallRule -DisplayName "PHI-DB Deny Internet Egress (SQL)" `
-Direction Outbound -Program "C:\Program Files\Microsoft SQL Server\*\sqlservr.exe" `
-RemoteAddress Internet -Action Block -Profile Any -ErrorAction SilentlyContinue
# 3) Find stale service accounts with interactive logon rights (common lateral-movement path)
Get-LocalGroupMember -Group "Remote Desktop Users" -ErrorAction SilentlyContinue |
Select-Object Name, ObjectClass, PrincipalSource
# 4) Check for suspicious large archives staged in temp directories (last 7 days)
$cutoff = (Get-Date).AddDays(-7)
Get-ChildItem -Path "$env:TEMP","C:\Windows\Temp","C:\ProgramData" -Recurse -Depth 2 `
-Include *.7z,*.rar,*.zip -ErrorAction SilentlyContinue |
Where-Object { $_.Length -gt 10MB -and $_.LastWriteTime -gt $cutoff } |
Select-Object FullName, Length, LastWriteTime | Format-Table -AutoSize
# 5) Confirm MFA is enforced on all remote access (VPN/RDP gateway) — verify, don't assume
Write-Output "[!] MANUAL CHECK: Confirm MFA on VPN, RDP Gateway, O365/M365, and EHR admin portals"
Remediation
Because these settlements stem from breach consequences rather than a single patchable flaw, remediation is a program-level effort. Prioritize in this order:
- Enforce MFA everywhere remotely reachable — VPN, RDP Gateway, webmail/M365, EHR admin consoles, and any third-party remote-support tooling. The majority of healthcare intrusions of this class begin with a phished or brute-forced credential on an internet-facing service.
- Inventory and baseline PHI-bearing hosts. You cannot detect anomalous egress from a database server if your SOC doesn't know which servers hold PHI. Maintain a CMDB tag for EHR databases, billing systems, imaging archives, and file shares containing patient records, and scope the detections above to that list.
- Egress filtering on data-bearing servers. Database and file servers have almost no legitimate reason to initiate internet connections. Block by default, allowlist vendor endpoints explicitly, and alert on every denied attempt — a blocked egress attempt from
sqlservr.exeis a near-perfect early warning. - Enable and centralize object-access auditing on PHI shares (Windows SACLs, Linux
auditd) with logs shipped off-box to your SIEM. Bulk-read events against patient directories are detectable if — and only if — this telemetry exists. - Segment clinical and administrative networks. Behavioral health and specialty practices often run flat networks where a single compromised workstation can reach every data store. VLAN segmentation with ACLs between clinical, administrative, and server zones is a CIS Control 3/12 baseline, not an optional enhancement.
- Exercise your breach-notification runbook. Both of these settlements turned on detection-to-notification timelines. Under HIPAA's Breach Notification Rule, you have 60 days from discovery. Tabletop the workflow — forensics, legal, HHS/OCR reporting, patient notification — annually, and after every material incident.
- Monitor third-party and business associate access. Review BAAs, audit remote-access accounts for billing/IT vendors, and require the same MFA and logging standards contractually. Supply-chain access is now a leading vector into mid-size practices.
No vendor advisory or patch applies to these incidents; the control gaps are architectural and procedural. Organizations operating under HIPAA should map the steps above against the NIST Cybersecurity Framework and the HHS 405(d) Health Industry Cybersecurity Practices (HICP) guidance, which remain the authoritative references regulators measure against in post-breach enforcement.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.