Loma Linda University Health and UCLA Health — two of California's largest academic medical systems — have recently announced data security incidents impacting protected health information (PHI). As reported by The HIPAA Journal, both organizations have begun the notification and remediation process required under HIPAA and California state breach notification law.
For defenders, the headline isn't just that these breaches happened — it's where they happened. Academic medical centers are among the most-targeted entities in the healthcare sector: sprawling networks, tens of thousands of endpoints, third-party vendor integrations, research data with nation-state value, and PHI with durable black-market value. When two major systems disclose incidents in the same reporting cycle, it's a signal to every healthcare CISO to re-validate their own exposure against the same attack surface.
If you operate a healthcare environment — or provide security services to one — treat these disclosures as a forcing function: audit your EHR access logging, email security controls, third-party vendor access, and breach response runbooks this week, not next quarter.
What We Know
Both incidents were publicly disclosed per HIPAA Breach Notification Rule requirements (45 CFR §§ 164.400–414), which mandate notification to affected individuals within 60 days of discovery for breaches affecting 500 or more individuals, along with notification to HHS Office for Civil Rights (OCR) and, in California, the state Attorney General when 500+ California residents are affected.
Healthcare breaches disclosed through this channel typically trace to a recurring set of root causes that we've seen repeatedly across our incident response engagements in the sector:
- Email account compromise (Business Email Compromise / credential phishing): A phished employee mailbox containing PHI in attachments, referral correspondence, or billing data is one of the most common breach vectors reported to OCR. Unauthorized mailbox access often persists for weeks before detection.
- Third-party/vendor compromise: Revenue cycle vendors, transcription services, collection agencies, IT service providers, and file transfer platforms are frequent upstream breach sources for health systems.
- EHR snooping and insider misuse: Unauthorized workforce access to patient records (VIP records, family members, identity theft rings) remains a persistent driver of reportable incidents.
- Web application and portal exposure: Patient portals, scheduling systems, and payment portals exposing records through misconfiguration or exploitation.
No CVE or specific exploited vulnerability has been publicly identified in connection with these disclosures, and we will not speculate on one. The defensive value here is in the pattern: healthcare breaches overwhelmingly originate from identity compromise and third-party access, not exotic zero-days.
Why Healthcare Defenders Must Act Now
The Threat Landscape Context
Healthcare remains the most expensive breach sector — the average healthcare breach cost has exceeded $10M per incident in recent industry reporting, and OCR enforcement activity has intensified. Beyond regulatory exposure, academic medical centers face:
- Ransomware operators (and their initial access brokers) who specifically target hospital identity infrastructure — phishing campaigns against healthcare workers surged through 2025 and continue into 2026.
- Nation-state interest in research data held by academic medical centers (clinical trials, genomic data, pharmaceutical IP).
- Medical identity theft markets — PHI retains value for years, unlike payment card data.
The Common Thread: Identity and Access Visibility
Across both disclosures, the defensive lesson converges on a single theme: you cannot protect what you cannot see. Most healthcare breach investigations we've supported revealed that the organization had the telemetry to detect the intrusion weeks earlier — in mailbox audit logs, EHR access logs, or VPN authentication records — but no one was correlating or alerting on it.
Detection & Response
The detections below target the most probable intrusion patterns behind healthcare-sector breaches of this type: mailbox compromise with PHI access, anomalous EHR access behavior, and bulk data staging/exfiltration. They are tuned for a hospital environment — validate thresholds against your own baselines before production deployment.
Sigma Rules
---
title: Suspicious Mailbox Inbox Rule Created for Email Hiding
tags:
- attack.persistence
- attack.t1098.002
- attack.collection
- attack.t1114.003
logsource:
product: m365
service: exchange
detection:
selection:
Operation: 'New-InboxRule'
Parameters|contains:
- 'DeleteMessage'
- 'MarkAsRead'
- 'MoveToFolder'
filter_archive:
Parameters|contains: 'RSS Feeds'
condition: selection and not filter_archive
falsepositives:
- Legitimate user-created rules for mail triage; investigate rules created shortly after impossible-travel or MFA-fatigue sign-in events
level: high
---
title: Impossible Travel Sign-In Followed by Mailbox Access
tags:
- attack.initial_access
- attack.t1078
logsource:
product: azure
service: signinlogs
detection:
selection:
riskDetail: 'unfamiliarFeatures'
selection_geo:
locationInfo.countryOrRegion|contains:
- 'RU'
- 'CN'
- 'NG'
- 'KP'
condition: selection or selection_geo
falsepositives:
- Staff traveling internationally; correlate with VPN enrollment and helpdesk travel notices
level: high
---
title: Bulk File Access on Network Share Consistent with Data Staging
tags:
- attack.collection
- attack.t1074
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- '\\Patients\\'
- '\\PHI\\'
- '\\Billing\\'
- '\\Medical Records\\'
filter_system:
Image|endswith:
- '\explorer.exe'
- '\OneDrive.exe'
condition: selection and not filter_system
falsepositives:
- Backup agents and DLP scanners; whitelist known service accounts by SID after validation
level: medium
KQL — Microsoft Sentinel / Defender Hunt Queries
This query hunts for anomalous mailbox access patterns in a healthcare environment — a single mailbox accessed from multiple geographies within a short window, followed by inbox rule creation. It uses the OfficeActivity and SigninLogs tables ingested into Sentinel.
// Hunt: Mailbox compromise pattern - multi-geo access + inbox rule creation
let Lookback = 14d;
let SuspiciousAccess =
SigninLogs
| where TimeGenerated > ago(Lookback)
| where AppDisplayName has_any ("Exchange", "Office 365")
| where ResultType == 0
| summarize GeoCount = dcount(Location), Locations = make_set(Location), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
by UserPrincipalName, IPAddress
| where GeoCount >= 3;
SuspiciousAccess
| join kind=inner (
OfficeActivity
| where TimeGenerated > ago(Lookback)
| where Operation in~ ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules")
| extend RuleParams = tostring(parse_json(Parameters))
| where RuleParams has_any ("DeleteMessage", "MarkAsRead", "MoveToFolder", "SoftDelete")
| project UserId, Operation, RuleParams, RuleCreated = TimeGenerated, ClientIP
) on $left.UserPrincipalName == $right.UserId
| project UserPrincipalName, GeoCount, Locations, FirstSeen, LastSeen, Operation, RuleCreated, ClientIP
| sort by RuleCreated asc;
This second query hunts for bulk document access on Windows file servers hosting PHI — a common precursor to reportable breaches. It uses DeviceFileEvents from Defender for Endpoint.
// Hunt: Abnormal volume of PHI-share file access per account (baseline deviation)
let Lookback = 7d;
DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where FolderPath has_any ("\\Patients\\", "\\PHI\\", "\\MedicalRecords\\", "\\Billing\\", "\\HIM\\")
| where ActionType in~ ("FileCreated", "FileModified", "FileRenamed")
| summarize FileOps = count(), DistinctFiles = dcount(FileName), FirstOp = min(TimeGenerated), LastOp = max(TimeGenerated)
by InitiatingProcessAccountName, DeviceName, bin(TimeGenerated, 1h)
| where FileOps > 200 // Tune against your baseline; HIM scanning workstations will be high
| extend OpsPerMinute = round(todouble(FileOps) / 60.0, 2)
| sort by FileOps desc;
Velociraptor VQL — Endpoint Hunt
Use this artifact across clinical workstations and file servers to identify processes performing bulk reads from PHI directories — catching staging behavior from commodity tooling (robocopy, rclone, 7zip) often seen in pre-ransomware and data-theft intrusions targeting hospitals.
-- Hunt for processes accessing PHI shares with bulk-copy tooling
SELECT Pid,
Name,
Exe,
CommandLine,
Username,
CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(robocopy|rclone|xcopy|7z|winrar|/MIR|\\Patients\\|\\PHI\\|\\Medical ?Records\\)'
AND NOT Exe =~ '(?i)(backup|veeam|commvault|dlp)'
Remediation & Hardening Actions
Whether or not your organization was affected by these specific incidents, the following actions close the most common gaps that lead to reportable healthcare breaches.
1. Identity & Email Security (Highest Priority)
Deploy this PowerShell audit against your Microsoft 365 tenant to surface the mailbox compromise patterns behind a large share of healthcare OCR breach reports. Run it against all users with access to PHI mailboxes (HIM, billing, clinical departments, executives).
# Connect-ExchangeOnline required. Run with Exchange Administrator or Global Reader + Search permissions.
Connect-ExchangeOnline
# 1. Find inbox rules with hiding/exfil characteristics across all mailboxes
Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox | ForEach-Object {
Get-InboxRule -Mailbox $_.PrimarySmtpAddress -ErrorAction SilentlyContinue |
Where-Object { $_.DeleteMessage -eq $true -or
$_.MarkAsRead -eq $true -or
($_.ForwardTo -ne $null) -or
($_.RedirectTo -ne $null) -or
($_.MoveToFolder -match 'RSS|Archive|Conversation History') } |
Select-Object @{N='Mailbox';E={$_.MailboxOwnerId}}, Name, ForwardTo, RedirectTo,
DeleteMessage, MarkAsRead, MoveToFolder
} | Export-Csv .\SuspiciousInboxRules.csv -NoTypeInformation
# 2. Identify mailboxes with forwarding enabled to external domains
Get-Mailbox -ResultSize Unlimited |
Where-Object { $_.ForwardingSmtpAddress -ne $null -or $_.ForwardingAddress -ne $null } |
Select-Object DisplayName, PrimarySmtpAddress, ForwardingSmtpAddress, ForwardingAddress |
Export-Csv .\MailboxForwarding.csv -NoTypeInformation
# 3. Check audit logging status (must be enabled for breach investigation under HIPAA)
Get-Mailbox -ResultSize Unlimited | Where-Object { $_.AuditEnabled -eq $false } |
Select-Object DisplayName, PrimarySmtpAddress, AuditEnabled
# 4. Remediate: block automatic external forwarding tenant-wide (verify no business dependency first)
Get-RemoteDomain | Where-Object { $_.AutoForwardEnabled -eq $true } |
Set-RemoteDomain -AutoForwardEnabled $false
Additional identity controls to validate immediately:
- Phishing-resistant MFA (FIDO2/passkeys) for all users with EHR or PHI system access — SMS and push-only MFA remain vulnerable to the fatigue and AiTM phishing kits driving current healthcare intrusions.
- Conditional Access policies blocking legacy authentication and enforcing geographic/device restrictions for remote access.
- Session revocation procedures tested and documented — during a breach, you must be able to kill all sessions for a compromised account in under 15 minutes.
2. EHR and PHI Access Monitoring
- Enable and centralize EHR audit logs (Epic, Cerner/Oracle Health, MEDITECH all generate them) into your SIEM. Alert on: access to VIP/restricted records, access to records of patients with no treatment relationship to the accessor, and after-hours bulk chart access.
- Implement break-the-glass alerting — every override should generate a reviewable event, not silent access.
- Deploy UEBA or baseline-based alerting for HIM and billing staff, whose accounts are high-value phishing targets due to broad PHI access.
3. Third-Party and Business Associate Risk
- Inventory every Business Associate Agreement (BAA) and map what PHI each vendor touches and through which technical pathway (SFTP, API, VPN, email).
- Enforce least-privilege, time-bound vendor access — standing VPN accounts for vendors are a recurring breach source.
- Require vendors to notify you of security incidents within contractually defined windows (24–72 hours) with named points of contact. The average healthcare breach in 2024–2025 originated upstream at a vendor; your detection surface must extend to them.
4. Breach Response Readiness
- Validate your 60-day notification clock runbook: who declares a breach, who determines scope, who drafts OCR/state AG notifications, and who handles call-center and credit-monitoring logistics. The clock starts at discovery, not confirmation.
- Pre-negotiate retainers with DFIR counsel and forensics firms — during an active incident you do not have time for procurement.
- Tabletop an email-compromise-with-PHI scenario this quarter. It is the statistically most likely reportable incident your organization will face.
5. Regulatory Context
- HIPAA Breach Notification Rule: individual notification within 60 days; HHS OCR notification within 60 days for 500+ individuals; media notification for 500+ in a single state/jurisdiction.
- California: notification to the Attorney General required when 500+ California residents are affected; California's CMIA (Civil Code § 56.10/56.36) adds medical-information-specific duties and potential penalties of up to $25,000 per violation for providers.
- OCR penalty exposure for the underlying Security Rule failure (not the breach itself) can reach $2M+ annually per violation category — the post-breach Risk Analysis and corrective action plan matter as much as the notification.
Bottom Line
The Loma Linda University Health and UCLA Health disclosures are a reminder that in healthcare, the breach is rarely the exotic exploit — it's the phished mailbox nobody was watching, the vendor account nobody deprovisioned, or the EHR access log nobody reviewed. The controls above are not aspirational; they are the baseline that OCR expects under the HIPAA Security Rule and that your incident response team will wish existed when the next disclosure has your organization's name on it.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.