Settlements have been reached to resolve class action data breach lawsuits against McKenzie Health System in Michigan and Aspire Health Alliance, closing another chapter in the relentless wave of healthcare breach litigation. While the headlines focus on the legal outcome, the operational reality for defenders is this: every one of these settlements represents an intrusion that detection controls missed, response processes failed to contain, and governance failed to prevent.
Healthcare remains the most expensive sector for data breaches for well over a decade running, and the plaintiffs' bar has industrialized breach litigation. The equation has changed. A breach is no longer just an incident response cost and an OCR investigation — it is a multi-year class action with discovery that will expose every gap in your security program to opposing counsel. If your organization cannot demonstrate reasonable, documented safeguards under the HIPAA Security Rule, you are underwriting your adversary's legal fees.
This post breaks down what these cases signal about the healthcare threat landscape in 2026 and, more importantly, the detection and hardening measures that would have changed the outcome.
The Threat Picture: How Healthcare Breaches Actually Happen
While specific technical details of these incidents are not fully public, the pattern across healthcare provider breaches over the past 24 months is remarkably consistent. In my experience leading IR engagements against hospital systems and behavioral health providers, the dominant intrusion chain looks like this:
- Initial access via phishing or credential harvesting — often targeting remote access portals, webmail, or VPN concentrators with weak or absent MFA. Infostealer-harvested credentials sold on initial access broker markets remain a top vector.
- Lateral movement to file shares and clinical systems — attackers enumerate SMB shares, document management systems, and legacy application servers housing PHI.
- Data staging and bulk collection — PHI is aggregated into archives (7-Zip, WinRAR) in user profiles, temp directories, or staging folders on servers.
- Exfiltration — outbound transfer over HTTPS to cloud storage (MEGA, Dropbox, attacker-controlled VPS) or via Rclone, frequently blended with legitimate traffic.
- Extortion — double-extortion ransomware groups (or data-theft-only crews) notify victims and list stolen data on leak sites. Settlement negotiations and class actions follow public breach notification.
Notably, many healthcare breach defendants in recent class actions were hit not by sophisticated zero-days but by missing fundamentals: no MFA on remote access, no EDR coverage on legacy servers, no egress filtering, no anomalous-access alerting on PHI repositories, and audit logs that were either absent or never reviewed. OCR enforcement actions and settlement agreements consistently cite failure to conduct an accurate and thorough risk analysis — a finding that is almost always preventable.
Affected entities in these cases: McKenzie Health System (Sandusky, Michigan — a rural community hospital) and Aspire Health Alliance (a Massachusetts behavioral health provider). Both illustrate that small and mid-sized providers are squarely in the crosshairs; attackers and litigators alike know these organizations carry PHI with a fraction of the security budget of a major academic medical center.
Detection & Response
The detections below target the highest-signal, lowest-noise behaviors in the healthcare breach kill chain: bulk archive creation on servers, mass PHI access anomalies, and exfiltration tooling. These are derived from the techniques that recur across healthcare breach investigations, not from any single indicator list.
Sigma Rules
---
title: Bulk Archive Creation on Server via 7-Zip or WinRAR
id: 3f8c2a71-6b4d-4e92-a1c7-9d5e2f8b0a34
status: experimental
description: Detects compression of data into archives by 7-Zip or WinRAR executed on server operating systems, a common PHI staging behavior prior to exfiltration in healthcare breaches.
references:
- https://attack.mitre.org/techniques/T1560/001/
- https://www.hipaajournal.com/mckenzie-health-system-aspire-health-alliance-data-breach-settlements/
author: Security Arsenal
date: 2026/02/14
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\7z.exe'
- '\7za.exe'
- '\7zg.exe'
- '\rar.exe'
- '\winrar.exe'
selection_cli:
CommandLine|contains:
- ' a '
- ' -tzip'
- ' -t7z'
filter_backup_tools:
Image|contains:
- '\Veeam\'
- '\Veritas\'
condition: selection_img and selection_cli and not filter_backup_tools
falsepositives:
- Backup and log rotation jobs (filter by service account and schedule)
- Software packaging by IT staff
level: high
---
title: Rclone Execution for Cloud Exfiltration
id: 8a1e4d62-3c7b-4f58-b6d2-1e9a0c4f7b85
status: experimental
description: Detects execution of Rclone or similar sync utilities commonly abused to exfiltrate staged PHI to cloud storage in double-extortion campaigns against healthcare providers.
references:
- https://attack.mitre.org/techniques/T1567/002/
- https://www.hipaajournal.com/mckenzie-health-system-aspire-health-alliance-data-breach-settlements/
author: Security Arsenal
date: 2026/02/14
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- 'rclone'
- 'copy --'
- 'sync --'
- '--transfers'
- '--config'
filter_legit:
Image|contains:
- '\Program Files\Rclone\'
User|contains: 'svc-backup'
condition: selection and not filter_legit
falsepositives:
- Sanctioned cloud backup pipelines using Rclone service accounts
level: high
---
title: Mass SMB File Access by Single User Account
id: 5b2f9e14-8d1a-4c63-a7f4-2b6e1d9c3a71
status: experimental
description: Detects an abnormally high volume of file share read operations by a single account in a short window, consistent with attacker enumeration and bulk collection of PHI from clinical file shares.
references:
- https://attack.mitre.org/techniques/T1213/
- https://www.hipaajournal.com/mckenzie-health-system-aspire-health-alliance-data-breach-settlements/
author: Security Arsenal
date: 2026/02/14
tags:
- attack.collection
- attack.t1005
logsource:
product: windows
service: security
detection:
selection:
AccessMask|contains:
- '0x120089'
- '0x1'
condition: selection | count() by SubjectUserName > 500
timeframe: 10m
falsepositives:
- Backup service accounts (exclude by naming convention)
- DLP and e-discovery crawlers (allowlist by account and source host)
level: medium
KQL — Microsoft Sentinel / Defender Hunting
This query hunts for anomalous outbound data transfer volume from servers hosting PHI, correlated with process execution of common exfiltration tooling. Tune the byte threshold to your environment's baseline.
let ExfilTools = dynamic(["rclone.exe", "megacmd.exe", "7z.exe", "rar.exe", "winscp.exe", "filezilla.exe", "curl.exe"]);
let SuspectProcs =
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ (ExfilTools)
| project DeviceName, DeviceId, ProcessTime=TimeGenerated, FileName, ProcessCommandLine, AccountName;
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where isnotempty(RemoteUrl) or isnotempty(RemoteIP)
| summarize TotalConnections=count(), DistinctDestinations=dcount(RemoteIP), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, InitiatingProcessFileName, RemoteIP
| join kind=inner (SuspectProcs) on DeviceName
| where DistinctDestinations < 5
| project DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteIP, TotalConnections, FirstSeen, LastSeen, AccountName
| order by TotalConnections desc
For organizations ingesting Windows file share auditing (Event 4663) into Sentinel, this companion query surfaces single accounts reading an abnormal number of files — the bulk-collection signature seen in nearly every healthcare breach investigation:
SecurityEvent
| where TimeGenerated > ago(6h)
| where EventID == 4663
| where ObjectType == "File"
| where AccessMask has "0x1" or AccessMask has "0x120089"
| where SubjectUserName !endswith "$" and SubjectUserName !startswith "svc-"
| summarize FilesRead=dcount(ObjectName), SharePaths=dcount(ipv4_is_private(IpAddress) ? "private" : "public"), FirstRead=min(TimeGenerated), LastRead=max(TimeGenerated) by SubjectUserName, Computer
| where FilesRead > 1000
| extend ReadWindowMinutes = datetime_diff("minute", LastRead, FirstRead)
| order by FilesRead desc
Velociraptor VQL — Hunt for Staged Archives
When you suspect data staging during an active investigation or proactive hunt, sweep endpoints for recently created large archives in user-writable and temp locations — the classic pre-exfiltration artifact:
-- Hunt for recently created large archives consistent with PHI staging
SELECT FullPath, Size, Mtime, Btime,
basename(path=FullPath) AS FileName
FROM glob(globs=[
'C:/Users/*/AppData/Local/Temp/**.{zip,7z,rar}',
'C:/Users/*/Desktop/**.{zip,7z,rar}',
'C:/ProgramData/**.{zip,7z,rar}',
'C:/Temp/**.{zip,7z,rar}'
])
WHERE Size > 10485760
AND Mtime > timestamp(epoch=now() - 604800)
ORDER BY Size DESC
PowerShell — Healthcare Breach Posture Verification
This script validates several of the controls whose absence most commonly appears in healthcare breach post-mortems and OCR corrective action plans. Run it against servers and key workstations during your next hardening cycle.
# Healthcare breach posture verification - run elevated
$report = @()
# 1. Verify advanced audit policy: file share access auditing enabled
$fileAudit = auditpol /get /subcategory:"File Share" 2>$null
$report += [pscustomobject]@{ Control = 'File Share Access Auditing'; Enabled = ($fileAudit -match 'Success') }
# 2. Verify Windows Defender real-time protection and cloud-delivered protection
$mp = Get-MpComputerStatus
$report += [pscustomobject]@{ Control = 'Defender Real-Time Protection'; Enabled = $mp.RealTimeProtectionEnabled }
$report += [pscustomobject]@{ Control = 'Defender Cloud Protection (MAPS)'; Enabled = ($mp.MAPSScanning -ne $false) }
# 3. Check for exposed RDP without Network Level Authentication
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
$report += [pscustomobject]@{ Control = 'RDP Disabled or NLA Enforced'; Enabled = (($rdp.fDenyTSConnections -eq 1) -or ($nla.UserAuthentication -eq 1)) }
# 4. Verify PowerShell Script Block Logging for post-exploitation visibility
$sbl = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name EnableScriptBlockLogging -ErrorAction SilentlyContinue
$report += [pscustomobject]@{ Control = 'PowerShell Script Block Logging'; Enabled = ($sbl.EnableScriptBlockLogging -eq 1) }
# 5. Check SMBv1 (legacy lateral movement vector) disabled
$smb1 = Get-SmbServerConfiguration | Select-Object -ExpandProperty EnableSMB1Protocol
$report += [pscustomobject]@{ Control = 'SMBv1 Disabled'; Enabled = (-not $smb1) }
# 6. List local administrators - flag unexpected accounts for review
$admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Name
$report += [pscustomobject]@{ Control = 'Local Admins (review required)'; Enabled = ($admins -join '; ') }
$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\BreachPostureAudit_$(hostname)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
# 7. Enable missing audit controls (uncomment after review)
# auditpol /set /subcategory:"File Share" /success:enable /failure:enable
# auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable
# Set-MpPreference -MAPSReporting Advanced
# Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
Remediation: What These Settlements Demand From Your Program
Class action settlements in healthcare breach cases follow a predictable discovery trail. Plaintiffs' experts will reconstruct your security posture from your own documentation — or lack of it. The remediation priorities below address the gaps that appear most frequently in these cases and in OCR's enforcement actions.
1. Close the remote access gap — universally, not selectively. Phishing-resistant MFA (FIDO2/passkeys) must cover VPN, webmail, EHR remote access, and every third-party remote support pathway. Rural hospitals and behavioral health providers are disproportionately breached through a single legacy VPN account or vendor remote access tool nobody remembered existed. Inventory every external authentication path this quarter.
2. Deploy EDR with 100% coverage — including the servers nobody touches. Legacy clinical application servers, interface engines, and imaging systems are the most common EDR coverage gaps I find in healthcare IR engagements. If a device stores or processes PHI, it needs detection telemetry. Isolate what cannot be covered behind compensating controls and document the exception — undocumented exceptions are discovery gold for plaintiffs.
3. Monitor PHI repositories for anomalous access. Enable and actually alert on file share auditing for repositories containing PHI. Baseline normal access; alert on bulk reads (the KQL above is your starting point). The mass-access signature is one of the highest-fidelity pre-exfiltration indicators available and is chronically under-deployed in healthcare.
4. Control egress. Outbound filtering that restricts servers to approved destinations would have stopped or throttled the exfiltration phase in a substantial percentage of healthcare breaches I have investigated. Block consumer cloud storage and unapproved sync tooling at the proxy and EDR layers.
5. Complete — and act on — your HIPAA Security Rule risk analysis. OCR settlement agreements cite inadequate risk analysis in the overwhelming majority of breach enforcement actions. The analysis must be enterprise-wide, current, and tied to a funded remediation roadmap. A risk analysis that identifies MFA gaps two years before the breach is worse than none at all.
6. Prepare for the legal reality. Retention of forensic artifacts, logging with adequate retention windows (12 months minimum), and a tested IR plan now directly determine litigation exposure. Breach counsel and a DFIR retainer should be in place before you need them. The settlements against McKenzie Health System and Aspire Health Alliance demonstrate that the financial tail of a breach now extends years past containment.
7. Segment ruthlessly. Behavioral health records carry heightened sensitivity (42 CFR Part 2 considerations on top of HIPAA). Flat networks let a single phished credential reach everything. VLAN isolation between clinical, administrative, and guest segments, with SMB restricted to need-to-have paths, collapses the blast radius of initial compromise.
The Bottom Line
These settlements are not outliers — they are the market price of preventable healthcare breaches in 2026. The techniques involved are neither novel nor elite: phished credentials, unmonitored file shares, staged archives, and bulk exfiltration over HTTPS. Every control above is achievable with existing tooling and disciplined execution. The organizations that avoid becoming the next headline are the ones that treat detection coverage, egress control, and documented risk management as non-negotiable operational requirements — because plaintiffs' attorneys and OCR already do.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.