Highlands Oncology Group Breach Settlement: Defensive Lessons From a Healthcare Encryption Attack

Highlands Oncology Group — a physician-owned community cancer care and research practice serving Northwest Arkansas, Southwest Missouri, and Southeast Oklahoma — has settled litigation stemming from a 2025 encryption-based cyber incident that disrupted operations and exposed patient data. While the settlement closes the legal chapter for affected patients, it opens an important one for defenders: oncology practices and mid-sized healthcare providers remain among the most consistently targeted verticals for encryption-and-extortion operations, and the technical patterns behind these intrusions are well understood and detectable.

For SOC teams supporting healthcare clients, this case is a reminder of three realities. First, encryption-based incidents against healthcare providers almost always involve a pre-encryption dwell period — reconnaissance, credential theft, staging, and increasingly, data exfiltration for double extortion. Second, the blast radius extends well beyond the ransom decision: litigation, OCR scrutiny under HIPAA, notification costs, and patient trust erosion follow for years. Third, the behaviors that precede detonation are loud. If your detection engineering is tuned for them, you have a fighting chance to interrupt the attack chain before the encryptor runs.

This post breaks down the attack pattern typical of these healthcare encryption incidents, and delivers production-ready detections and hardening guidance your team can deploy today.

Technical Analysis

What Happened

Highlands Oncology Group disclosed an encryption-based cyber incident in 2025. Threat actors gained access to the practice's environment, deployed encryption against systems, and — consistent with modern ransomware tradecraft — the incident resulted in unauthorized access to sensitive patient information. The practice treats cancer patients across a tri-state region, meaning the data at risk includes some of the most sensitive records in healthcare: oncology diagnoses, treatment plans, genetic and pathology data, insurance information, and Social Security numbers. Litigation followed, and the parties have now reached a settlement.

No CVE was identified in public reporting of this incident — initial access in healthcare ransomware cases of this type typically traces to one of a small set of vectors: phishing-driven credential theft, exposed remote access services (RDP, VPN appliances), or exploitation of edge devices. The absence of a named vulnerability does not reduce the defensive lesson: the post-compromise behavior is where detection wins or loses.

The Attack Chain Defenders Should Model

Encryption-based healthcare intrusions generally follow a repeatable sequence:

1. Initial access — Phishing, compromised VPN/RDP credentials, or exploitation of an internet-facing appliance. Valid account usage (MITRE ATT&CK T1078) is the norm, not the exception.
2. Discovery and credential access — Attackers enumerate the domain, dump credentials from memory or LSASS-adjacent stores, and identify backup infrastructure and EHR-adjacent systems.
3. Staging and exfiltration — In double-extortion operations, patient data is staged into archives and exfiltrated over Rclone, MEGA, or attacker-controlled infrastructure before encryption. This is what converts an IT outage into a reportable HIPAA breach and, ultimately, litigation.
4. Impact preparation — Shadow copies are deleted, recovery options are disabled via bcdedit, and backup agents/services are stopped or uninstalled.
5. Encryption detonation — The encryptor executes across hosts, often pushed via Group Policy, PsExec-style tooling, or RMM software already present in the environment.

Every one of stages 2 through 5 generates high-fidelity telemetry. The dwell window — often days — is the defender's opportunity.

Why Healthcare, Why Oncology

Oncology practices are high-value targets for three reasons: the data is extraordinarily sensitive (maximizing extortion leverage), clinical uptime is life-safety adjacent (maximizing payment pressure), and community practices typically run lean IT teams without 24/7 monitoring. Threat actors know this. The settlement here illustrates the downstream cost model: even where care continuity is restored, breach notification, credit monitoring, settlement funds, and regulatory exposure dwarf the ransom itself.

Detection & Response

The detections below target the highest-signal, lowest-noise behaviors in the pre-encryption and detonation phases. These are the behaviors we hunt for proactively in every healthcare environment we monitor, because they are essentially never legitimate in concert.

Sigma Rules

---
title: Shadow Copy Deletion via vssadmin or wmic
title_fr: Suppression des clichés instantanés
id: 3f7a2c91-8d4e-4b6a-9c21-5e8f0a1b2d3e
status: experimental
description: Detects deletion of Volume Shadow Copies, a hallmark pre-encryption ransomware behavior observed in healthcare encryption incidents such as the Highlands Oncology intrusion pattern.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
  condition: selection_img and selection_cli
falsepositives:
  - Rare; legitimate backup maintenance typically uses vendor tooling, not direct vssadmin deletion
level: high
---
title: Boot Recovery Options Disabled via bcdedit
id: 9c1e4b72-2f8a-4d5c-b3e7-6a9d0f2c4e1b
status: experimental
description: Detects use of bcdedit to disable Windows recovery mode and ignore boot failures, a consistent ransomware pre-detonation step that inhibits victim recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
falsepositives:
  - Occasional golden-image or kiosk hardening scripts; baseline and whitelist known build tooling
level: high
---
title: Mass Archive Creation for Staged Exfiltration
id: 5b8d3e60-1a7c-4f9b-8e24-3c6a1d5f7b90
status: experimental
description: Detects command-line archive utilities compressing directories commonly associated with patient data staging prior to exfiltration in double-extortion operations.
references:
  - https://attack.mitre.org/techniques/T1560.001/
  - https://attack.mitre.org/techniques/T1048/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' -a '
      - 'copy '
      - 'sync '
      - '--transfers'
      - ' -r '
  filter_paths:
    CommandLine|contains:
      - '\Program Files\7-Zip\'
  condition: selection_img and selection_cli and not filter_paths
falsepositives:
  - Legitimate backup or file-sync jobs; tune against known backup service accounts and scheduled task contexts
level: medium

KQL — Microsoft Sentinel / Defender

This query hunts for the correlated pre-encryption sequence: shadow copy tampering or recovery disabling, followed within a short window by mass file modification on the same device. Run it as a scheduled analytic rule with a low threshold — the combination is rarely benign.

let lookback = 7d;
let tamper =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_any ("delete shadows", "resize shadowstorage"))
        or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "ignoreallfailures"))
        or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete backup")
    | project TamperTime=Timestamp, DeviceName, DeviceId, TamperCommand=ProcessCommandLine, AccountName;
let encryptSuspect =
    DeviceFileEvents
    | where Timestamp > ago(lookback)
    | where ActionType in ("FileRenamed", "FileModified")
    | where FolderPath has_any ("\\Documents\\", "\\Desktop\\", "\\Shares\\", "\\Patients\\") or FileName has_any (".pdf", ".docx", ".xlsx", ".dcm")
    | summarize ModCount=count(), DistinctExtensions=dcount(strcat(parse_path(FolderPath).Extension)) by DeviceId, bin(Timestamp, 15m)
    | where ModCount > 500;
tamper
| join kind=inner (encryptSuspect) on DeviceId
| where Timestamp > TamperTime and Timestamp < TamperTime + 4h
| project DeviceName, AccountName, TamperTime, TamperCommand, BurstTime=Timestamp, ModCount
| sort by TamperTime desc

A second hunt worth running weekly: Rclone or similar sync tooling executing under any context in a clinical environment. Almost no legitimate healthcare workflow requires Rclone.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("rclone.exe", "megacmd.exe", "filezilla.exe")
    or ProcessCommandLine has_any ("--transfers", "mega.nz", "rclone copy", "rclone sync")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc

Velociraptor VQL

For DFIR triage or proactive hunting across a healthcare fleet, this artifact surfaces shadow copy tampering and recovery tampering execution artifacts, plus suspicious sync-tool binaries.

-- Hunt: Pre-encryption tampering and exfiltration tooling on Windows endpoints
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|ignoreallfailures|delete backup)'
   OR Exe =~ '(?i)(rclone|megacmd|winscp|filezilla)'
   OR Name =~ '(?i)(vssadmin|bcdedit|wbadmin)'

Pair it with a filesystem artifact check for recently dropped ransom notes, which typically appear before full encryption completes and can give responders an early tripwire:

-- Hunt: Ransom note artifacts dropped in user-writable directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Users/*/Desktop/*README*.txt',
  'C:/Users/*/Documents/*README*.txt',
  'C:/*/RECOVER*.txt',
  'C:/*/HOW_TO_DECRYPT*.txt',
  'C:/*/*RESTORE*.html'
])
WHERE Mtime > Now() - 86400 * 7

Hardening & Verification Script

Run this PowerShell audit across Windows endpoints and servers (including those hosting EHR databases and imaging systems) to verify recovery posture and flag common pre-encryption weaknesses. It is read-only and safe for production.

# Healthcare ransomware posture audit — run elevated
$report = [ordered]@{}

# 1. Verify Volume Shadow Copies exist and VSS is healthy
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report.ShadowCopyCount = ($shadows | Measure-Object).Count
$report.VSSService = (Get-Service VSS -ErrorAction SilentlyContinue).Status

# 2. Check that recovery is NOT disabled (bcdedit tamper check)
$bcd = bcdedit /enum "{current}" 2>$null | Out-String
$report.RecoveryDisabled = ($bcd -match 'recoveryenabled\s+No')
$report.IgnoreAllFailures = ($bcd -match 'ignoreallfailures')

# 3. Audit for suspicious sync/exfil tooling
$suspect = @('rclone.exe','megacmd.exe')
$found = foreach ($t in $suspect) {
    Get-ChildItem -Path 'C:\','C:\Program Files','C:\Program Files (x86)' -Filter $t -Recurse -ErrorAction SilentlyContinue -Depth 4 | Select-Object -First 3 -ExpandProperty FullName
}
$report.ExfilToolingFound = $found

# 4. Confirm SMBv1 is disabled (legacy lateral-movement path)
$report.SMBv1Enabled = (Get-SmbServerConfiguration).EnableSMB1Protocol

# 5. Check LSA protection (credential-theft mitigation)
$report.LSAPPL = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue).RunAsPPL

# 6. Verify real-time AV/EDR state
$report.DefenderRealTime = (Get-MpComputerStatus -ErrorAction SilentlyContinue).RealTimeProtectionEnabled
$report.TamperProtection = (Get-MpComputerStatus -ErrorAction SilentlyContinue).IsTamperProtected

[pscustomobject]$report | Format-List

# Alert conditions a SOC should page on:
if ($report.RecoveryDisabled -or $report.IgnoreAllFailures) { Write-Warning 'CRITICAL: Boot recovery tampered — investigate immediately (T1490 pattern).' }
if ($report.ShadowCopyCount -eq 0) { Write-Warning 'WARNING: No shadow copies present — verify backup strategy.' }
if ($report.ExfilToolingFound) { Write-Warning "WARNING: Exfil-capable tooling found: $($report.ExfilToolingFound -join ', ')" }

Remediation

If your organization is responding to — or hardening against — this class of encryption-based incident, prioritize in this order:

1. Assume double extortion. Treat every encryption event as a data breach until forensic analysis proves otherwise. Preserve EDR telemetry, firewall/VPN logs, and proxy data before any rebuild. The litigation Highlands Oncology just settled exists because data left the building, not merely because files were encrypted.
2. Protect recovery before you need it. Enable tamper protection on your EDR, restrict vssadmin/bcdedit/wbadmin execution to a small set of admin accounts via AppLocker or WDAC, and maintain at least one immutable or offline backup copy. Test restoration of your EHR and imaging systems quarterly — a backup that has never been restored is a hypothesis, not a control.
3. Kill the staging window. Alert on the tamper behaviors in the detections above with paging-level severity. The hours between shadow copy deletion and mass encryption are your last, best intervention point.
4. Harden initial access paths. Enforce phishing-resistant MFA on VPN, remote access, and email; disable SMBv1; enable LSA protection (RunAsPPL); and patch internet-facing appliances on an accelerated cadence. Mid-sized practices should treat edge devices (VPN concentrators, firewalls, remote access portals) as their single most likely entry point.
5. Segment clinical from corporate. Oncology practices run flat networks far too often. Segment EHR databases, infusion/pharmacy systems, and PACS imaging from general user VLANs so a single compromised workstation cannot reach everything.
6. Meet HIPAA obligations deliberately. If PHI is implicated, engage counsel and your cyber insurer early, document your forensic timeline, and prepare for OCR review. The cost trajectory of this case — incident to litigation to settlement — is now the standard playbook; budget and plan for it in your IR retainers and tabletop exercises.
7. Tabletop the scenario. Run an annual ransomware exercise that includes the decision points this incident surfaced: clinical downtime procedures for active chemotherapy patients, notification thresholds, and settlement/extortion negotiation authorities.

The Highlands Oncology settlement is not an anomaly — it is the template. Healthcare organizations that instrument the pre-encryption behaviors above, protect their recovery paths, and rehearse the legal and clinical dimensions of response will be the ones that avoid becoming the next headline.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub