State attorneys general have been notified of a substantial data breach at Marathon Health, a national provider of employer-sponsored and onsite healthcare services, reportedly affecting approximately 5.7 million individuals. According to reporting by The HIPAA Journal, the incident involved unauthorized access to personal and protected health information (PHI) — the exact category of data that carries the highest regulatory exposure under HIPAA and the highest black-market value per record of any data class.
At the time of writing, Marathon Health has not publicly disclosed the initial access vector, dwell time, or the specific threat actor involved. That is typical in the first days of attorney general notification — the HHS Office for Civil Rights (OCR) breach portal entry and forensic details generally follow. What we do know is sufficient to act: an adversary gained access to systems housing PHI at scale, and data belonging to millions of patients is now presumed exposed.
For healthcare security teams, this is not a story to read — it is a scenario to rehearse against your own environment. Employer-clinic operators, occupational health providers, and any organization aggregating PHI across multiple client populations present exactly the same concentrated target profile. The sections below provide the detection content and hardening guidance your SOC should operationalize this week.
Technical Analysis: Why Healthcare Aggregators Are High-Value Targets
What is at stake
Breaches of this scale at healthcare services firms almost always involve one or more of the following data elements, each of which drives a distinct harm and regulatory obligation:
- Full identity data — names, dates of birth, Social Security numbers, addresses (enables synthetic identity fraud and tax fraud)
- Clinical data — diagnoses, treatment records, lab results, prescriptions (enables medical identity theft and extortion)
- Insurance and billing data — member IDs, claims information (enables insurance fraud)
- Employment-linked data — employer names and occupational health records (creates additional notification complexity across hundreds of client organizations)
The 5.7 million figure places this among the largest healthcare breaches reported to regulators in recent memory, in the same tier as the Change Healthcare incident. Because Marathon Health serves employer clients, downstream notification obligations likely extend well beyond the provider itself.
The typical attack chain in healthcare aggregator breaches
While the Marathon Health intrusion vector is unconfirmed, large-scale PHI breaches in this sector consistently follow a recognizable pattern that defenders can hunt against regardless of the specific entry point:
- Initial access — phishing, compromised remote access (VPN/RDP without phishing-resistant MFA), or exploitation of an internet-facing appliance
- Persistence and privilege escalation — local admin compromise, credential dumping, service account abuse
- Discovery of PHI repositories — enumeration of file shares, EHR-adjacent databases, and reporting/BI exports, which are frequently far less protected than the EHR itself
- Collection and staging — bulk copying of records into a staging directory, followed by compression with tools like 7-Zip or WinRAR (often renamed or sideloaded)
- Exfiltration — multi-gigabyte outbound transfers over HTTPS to cloud storage (MEGA, Dropbox, S3, Rclone-configured endpoints) or attacker infrastructure
- Extortion phase — in double-extortion incidents, notification to regulators and victims often arrives only after ransom negotiations fail
Exploitation status
No CVE has been associated with this incident in public reporting, and none should be assumed. The exploitable weakness in most healthcare breaches is architectural: flat access to aggregated PHI, absent egress monitoring, and insufficient file-access auditing on the shares and databases where records actually live. That is what the detections below target.
Affected parties and regulatory posture
- Affected individuals: ~5.7 million (per AG notifications)
- Regulatory exposure: HIPAA Breach Notification Rule (45 CFR §§ 164.400-414) requires individual notification within 60 days of discovery; HHS OCR notification and media notice are mandatory for breaches affecting 500+ individuals; state AG notification requirements apply in every state where affected individuals reside
- Business associate implications: Employer clients of Marathon Health should review BAAs and determine whether their employee populations are affected
Detection & Response
The detections below target the collection, staging, and exfiltration phases — the behaviors that are common to virtually every mass-PHI breach and are observable regardless of initial access vector. Tune volume thresholds to your environment's baseline; a benefits enrollment system legitimately moving 50 GB nightly is different from a workstation suddenly archiving a file share.
---
title: Mass Compression Tool Execution on File Servers or Endpoints
description: Detects execution of archive utilities commonly abused to stage PHI or other bulk data prior to exfiltration, including renamed binaries running from non-standard paths.
references:
- https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/02/14
logsource:
category: process_creation
product: windows
detection:
selection_binary:
Image|endswith:
- '\7z.exe'
- '\7za.exe'
- '\rar.exe'
- '\winrar.exe'
selection_args:
CommandLine|contains:
- ' a '
- '-p'
filter_known_paths:
Image|startswith:
- 'C:\Program Files\7-Zip\'
- 'C:\Program Files\WinRAR\'
condition: (selection_binary and selection_args) and not filter_known_paths
falsepositives:
- IT administrators archiving backups
- Software packaging activity
level: high
---
title: Suspicious Archive or Staging Directory Creation on Servers
description: Detects creation of common staging directories or compressed archives in temp/public locations on servers, a hallmark of pre-exfiltration data collection.
references:
- https://attack.mitre.org/techniques/T1074/001/
author: Security Arsenal
date: 2026/02/14
logsource:
category: file_event
product: windows
detection:
selection_paths:
TargetFilename|startswith:
- 'C:\ProgramData\'
- 'C:\Windows\Temp\'
- 'C:\Users\Public\'
selection_ext:
TargetFilename|endswith:
- '.7z'
- '.rar'
- '.zip'
- '.tar.gz'
condition: selection_paths and selection_ext
falsepositives:
- Legitimate software installers unpacking to temp paths
- Endpoint management agents staging packages
level: medium
---
title: Rclone or Cloud Sync Tool Execution on Servers
description: Detects execution of rclone or similar cloud synchronization utilities on servers, a frequent exfiltration channel for bulk healthcare data theft.
references:
- https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/02/14
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- 'rclone'
- 'megacmd'
- ' --drive-server-side-across-configs'
- ' copy --'
- ' sync --'
- 'mega.nz'
- 'dropbox.com'
condition: selection
falsepositives:
- Sanctioned cloud backup tooling (whitelist by approved config path and service account)
level: high
// Hunt: anomalous large outbound transfers from servers hosting PHI repositories
// Baseline deviation per device over the last 14 days vs. the prior 14 days
let Lookback = 14d;
let Recent =
DeviceNetworkEvents
| where TimeStamp > ago(Lookback)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| summarize RecentBytes = sum(tolong(ResponseBytes)), RecentDestinations = dcount(RemoteUrl)
by DeviceName, InitiatingProcessFileName;
let Baseline =
DeviceNetworkEvents
| where TimeStamp between (ago(Lookback * 2) .. ago(Lookback))
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| summarize BaselineBytes = sum(tolong(ResponseBytes))
by DeviceName, InitiatingProcessFileName;
Recent
| join kind=leftouter Baseline on DeviceName, InitiatingProcessFileName
| extend BaselineBytes = coalesce(BaselineBytes, 0)
| where RecentBytes > 500000000 // >500 MB outbound in 14 days
| where BaselineBytes == 0 or RecentBytes > BaselineBytes * 10
| project DeviceName, InitiatingProcessFileName, RecentDestinations,
RecentMB = round(RecentBytes / 1000000, 1),
BaselineMB = round(BaselineBytes / 1000000, 1)
| order by RecentMB desc;
-- Hunt for staging artifacts and archive tool execution across endpoints
-- Deploy as a multi-artifact collection on servers and PHI-adjacent workstations
-- 1. Archive tool binaries executing from non-standard locations
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(7z|7za|rar|winrar|rclone|megacmd)'
AND Exe !~ '(?i)Program Files'
-- 2. Compressed archives staged in temp/public directories in the last 7 days
SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/ProgramData/**/*.7z',
'C:/ProgramData/**/*.rar',
'C:/Users/Public/**/*.7z',
'C:/Users/Public/**/*.rar',
'C:/Windows/Temp/**/*.7z',
'C:/Windows/Temp/**/*.rar'])
WHERE Mtime > now() - 604800
AND Size > 50000000
Post-breach verification script
Use the following on file servers and systems adjacent to PHI repositories to confirm object-access auditing is enabled (a prerequisite for detecting bulk file reads), and to surface recently created large archives that warrant triage.
# Verify object access auditing is enabled for file servers hosting PHI
auditpol /get /subcategory:"File System" | Select-String "Success and Failure"
# Enable auditing on a PHI share (run on each repository server)
$share = "D:\PHI_Share"
$acl = Get-Acl $share
$audit = New-Object System.Security.AccessControl.FileSystemAuditRule(
"Everyone","ReadData,WriteData,Delete","ContainerInherit,ObjectInherit","None","Success")
$acl.AddAuditRule($audit)
Set-Acl $share $acl
# Find large archives created in the last 30 days outside approved backup paths
Get-ChildItem -Path C:\,D:\ -Recurse -Include *.7z,*.rar,*.zip -ErrorAction SilentlyContinue |
Where-Object { $_.Length -gt 100MB -and $_.CreationTime -gt (Get-Date).AddDays(-30) -and
$_.FullName -notmatch 'Backup|Veeam' } |
Select-Object FullName, @{N='SizeMB';E={[math]::Round($_.Length/1MB)}}, CreationTime
# Identify recent high-volume outbound connections per process (top talkers)
Get-NetTCPConnection -State Established |
Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)' } |
Group-Object OwningProcess | Sort-Object Count -Descending | Select-Object -First 20 |
ForEach-Object { (Get-Process -Id $_.Name -ErrorAction SilentlyContinue).ProcessName }
Remediation and Hardening Guidance
Because the intrusion vector is undisclosed, remediation here is about ensuring your organization cannot be the next headline. Prioritize in this order:
- Inventory where PHI actually lives. In most healthcare environments we assess, the EHR is well-controlled while exports, reporting databases, claims files, and HR-adjacent shares are not. Map every repository; you cannot detect staging against data you don't know exists.
- Enforce phishing-resistant MFA (FIDO2/passkeys) on all remote access, email, and administrative interfaces. Credential compromise remains the dominant entry vector in healthcare breaches.
- Enable and centralize file-access auditing on PHI repositories (Windows: Object Access auditing + SACLs; forward to your SIEM). Alert on single accounts reading thousands of distinct files — bulk reads are the precursor to every mass exfiltration.
- Egress control and monitoring. Deny outbound traffic from servers to unsanctioned destinations by default. Alert on connections to file-sharing and cloud storage services not on an approved list, and on sustained multi-hundred-megabyte outbound transfers from PHI-adjacent systems.
- Restrict archive and sync tooling. Application control (AppLocker/WDAC) should block 7-Zip, WinRAR, rclone, and similar binaries from executing outside approved paths or service accounts.
- Segment and minimize. Employer-clinic operators should logically isolate each client population's data. Segmentation is the difference between a contained incident and a 5.7-million-record notification.
- Rehearse HIPAA breach notification. The 60-day clock under the Breach Notification Rule starts at discovery. Pre-stage your forensics retainer, legal counsel, notification vendor, and OCR/AG notification templates. Organizations that improvise this timeline miss it.
- If you are a Marathon Health client: Confirm whether your employee population is affected, review your BAA, and prepare internal communications. Affected individuals should be offered credit monitoring and given clear guidance on medical identity theft — a harm credit monitoring does not address.
Bottom Line
A 5.7-million-record breach at a national health services provider is a reminder that PHI aggregation without commensurate detection engineering is an extinction-level risk for mid-size healthcare firms. The attackers' entry point will be disclosed eventually; their collection, staging, and exfiltration behaviors are predictable today. Deploy the detections above, baseline your egress, and make sure that if it happens to you, your SOC sees it in hours — not after the attorney general does.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.