Notification letters are being mailed to individuals affected by data breaches at MedImpact Healthcare Systems, a pharmacy benefit management (PBM) service provider, and Rosch Visionary Systems, an ophthalmology practice. As reported by The HIPAA Journal, both organizations have begun the legally required process of notifying impacted individuals under HIPAA's Breach Notification Rule (45 CFR §§ 164.400–414).
On the surface, these are two unrelated incidents at two very different organizations — a large PBM that processes prescription drug benefits for millions of members, and a specialty eye care practice. But taken together, they illustrate the two breach vectors I see most often in healthcare incident response engagements: concentrated third-party data aggregators (PBMs, clearinghouses, billing vendors) that become single points of catastrophic failure, and small-to-midsize specialty practices that hold rich PHI but lack mature security programs.
If your organization exchanges data with a PBM, a billing service, or any downstream business associate — or if you are a specialty provider yourself — these incidents should trigger an immediate review of your own exposure, your business associate agreements (BAAs), and your detection posture.
Technical Analysis: Why These Two Breach Profiles Matter
The PBM Problem: Concentration Risk
Pharmacy benefit managers sit at the center of an enormous data web. A PBM like MedImpact processes:
- Member PII/PHI: names, addresses, dates of birth, Social Security numbers, member IDs
- Prescription histories: drug names, prescribing providers, fill dates — data that reveals diagnoses (HIV medications, psychiatric drugs, oncology treatments)
- Claims and financial data: bank details, payment card information in some flows
- Provider network data: NPIs, prescribing patterns
When a PBM is breached, the blast radius isn't one covered entity — it's every health plan, employer group, and health system that contracts with it. This is the same systemic-risk pattern we saw with the Change Healthcare ransomware attack, which cascaded across the entire US healthcare ecosystem. PBMs and clearinghouses are now firmly in threat actors' targeting logic: one intrusion yields data belonging to dozens of covered entities and millions of patients.
The Specialty Practice Problem: Soft Targets with Rich Data
Ophthalmology and other specialty practices like Rosch Visionary Systems typically hold complete patient charts, diagnostic imaging, insurance information, and often SSNs and payment data — but frequently operate with small IT teams, legacy practice management systems, and limited logging. In my DFIR casework, the dominant intrusion vectors against practices of this size remain:
- Phishing-led credential compromise of Microsoft 365 or remote access accounts, often without MFA
- Exploitation of exposed remote access (RDP, VPN appliances) followed by hands-on-keyboard intrusion
- Ransomware or double-extortion groups staging data exfiltration before encryption
- Compromise of a downstream vendor (billing, transcription, IT MSP) with standing access to the practice's network or EHR
Exploitation Status
No CVE or specific exploited vulnerability has been publicly identified in connection with either incident at this time — public breach notices rarely disclose root cause this early. The operative defensive question is not "which CVE" but "which behaviors": unauthorized access to systems holding PHI, bulk data staging and egress, and the dwell time between intrusion and detection. HIPAA's 60-day notification clock means these incidents were discovered weeks to months before public disclosure — a reminder that absence of detection is not absence of compromise.
Detection & Response
The detections below target the behaviors most commonly observed in healthcare breaches of this profile: bulk access to patient data repositories, staging and exfiltration of PHI, and suspicious mailbox activity associated with phishing-led compromise. They are tuned for relevance, not breadth.
Sigma Rules
---
title: Bulk Compression of Patient Data Directories
description: Detects archive utilities compressing directories likely to contain PHI, a common staging behavior before exfiltration from file shares, EHR exports, or claims repositories.
references:
- https://attack.mitre.org/techniques/T1560/001/
- https://www.hipaajournal.com/data-breaches-medimpact-healthcare-systems-rosch-visionary-systems/
author: Security Arsenal
date: 2026/04/06
id: 6b1f2a94-3c7e-4d58-9f21-8a4c5e6d7b90
status: experimental
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection_tool:
Image|endswith:
- '\7z.exe'
- '\7za.exe'
- '\rar.exe'
- '\winrar.exe'
- '\zip.exe'
selection_args:
CommandLine|contains:
- ' a '
- ' -a'
selection_target:
CommandLine|contains:
- 'patient'
- 'claims'
- 'members'
- 'ehr'
- 'phi'
- 'export'
- 'backup'
- 'rx'
condition: selection_tool and selection_args and selection_target
falsepositives:
- Scheduled backup and archival jobs run by IT; baseline by service account and host
level: high
---
title: Rclone or File Sync Tool Execution by Non-Standard Account
description: Detects execution of rclone or similar cloud sync tools frequently used for bulk exfiltration of PHI to attacker-controlled cloud storage in healthcare intrusions.
references:
- https://attack.mitre.org/techniques/T1567/002/
- https://www.hipaajournal.com/data-breaches-medimpact-healthcare-systems-rosch-visionary-systems/
author: Security Arsenal
date: 2026/04/06
id: 9d2e7c41-5b8f-4a63-bc74-1e9f0a2d3c56
status: experimental
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\rclone.exe'
- '\megacmd.exe'
- '\aws.exe'
- '\azcopy.exe'
selection_cli:
CommandLine|contains:
- 'copy'
- 'sync'
- 'move'
filter_authorized:
User|contains:
- 'svc-backup'
- 'svc-veeam'
condition: selection_img and selection_cli and not filter_authorized
falsepositives:
- Approved cloud backup integrations; maintain an explicit allowlist of service accounts and update filters
level: high
---
title: Suspicious Microsoft 365 Inbox Rule Hiding or Forwarding Mail
description: Detects creation of inbox rules that forward, delete, or hide mail — a hallmark of business email compromise leading to healthcare breach via mailbox data theft.
references:
- https://attack.mitre.org/techniques/T1098/002/
- https://attack.mitre.org/techniques/T1114/003/
author: Security Arsenal
date: 2026/04/06
id: 4f8a1d36-7e2b-4c95-8d16-3b7a9e0f5c82
status: experimental
tags:
- attack.persistence
- attack.collection
- attack.t1098.002
- attack.t1114.003
logsource:
product: m365
service: exchange
detection:
selection:
Operation:
- 'New-InboxRule'
- 'Set-InboxRule'
selection_suspicious:
Parameters|contains:
- 'ForwardTo'
- 'ForwardAsAttachmentTo'
- 'RedirectTo'
- 'DeleteMessage'
- 'MarkAsRead'
condition: selection and selection_suspicious
falsepositives:
- Users creating legitimate forwarding rules; investigate external forwarding destinations and rules created from unusual geographies or anonymous IPs
level: medium
KQL — Microsoft Sentinel / Defender Hunting
This query hunts for anomalous bulk read/copy activity against shares commonly hosting PHI exports, correlated with egress volume — the pattern that typically precedes a healthcare breach disclosure.
// Hunt: high-volume file access on PHI-designated shares followed by egress
let PhiShares = dynamic(["patient", "claims", "members", "ehr", "exports", "phi"]);
let Lookback = 7d;
let FileActivity = DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where FolderPath has_any (PhiShares)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| summarize FileOps = count(), DistinctFiles = dcount(FileName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName
| where FileOps > 200;
let Egress = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteIPType == "Public"
| summarize Connections = count(), RemoteIPs = dcount(RemoteIP) by DeviceName, InitiatingProcessFileName;
FileActivity
| join kind=inner Egress on DeviceName
| project DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileOps, DistinctFiles, Connections, RemoteIPs, FirstSeen, LastSeen
| sort by FileOps desc
Velociraptor VQL
This artifact enumerates archive-utility and sync-tool execution artifacts (prefetch) across endpoints to identify staging and exfiltration tooling before or after a suspected intrusion window.
-- Hunt for staging/exfil tool execution evidence via Prefetch
SELECT Name.OSPath AS PrefetchFile,
Name.Base AS BinaryName,
Mtime AS LastExecutionEvidence,
System() AS Hostname
FROM glob(globs='C:/Windows/Prefetch/*.pf')
WHERE BinaryName =~ '(?i)(7z|rar|winrar|rclone|megacmd|azcopy|filezilla|winscp)'
ORDER BY Mtime DESC
Remediation / Verification Script
Use this PowerShell to quickly audit for the highest-risk hygiene gaps observed in healthcare breaches: external forwarding rules in Exchange Online, accounts without MFA via legacy sign-ins, and unauthorized sync/archiving tools on servers holding PHI.
# Healthcare breach-readiness audit: mailbox rules, MFA gaps, exfil tooling
# Run with appropriate Exchange Online / Graph permissions
# 1) Find inbox rules forwarding externally (BEC indicator)
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
Get-InboxRule -Mailbox $_.UserPrincipalName -ErrorAction SilentlyContinue |
Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } |
Select-Object @{n='Mailbox';e={$_.MailboxOwnerId}}, Name, ForwardTo, RedirectTo
} | Export-Csv .\ExternalForwardingRules.csv -NoTypeInformation
# 2) Users with SMTP auto-forwarding enabled at the mailbox level
Get-Mailbox -ResultSize Unlimited |
Where-Object { $_.ForwardingSmtpAddress -ne $null -or $_.DeliverToMailboxAndForward -eq $true } |
Select-Object UserPrincipalName, ForwardingSmtpAddress, DeliverToMailboxAndForward
# 3) Scan servers for exfiltration-capable tooling not on your approved list
$approved = @('veeam', 'datto', 'rubrik')
$tools = 'rclone.exe','megacmd.exe','filezilla.exe','winscp.exe','azcopy.exe'
foreach ($tool in $tools) {
Get-ChildItem -Path C:\ -Filter $tool -Recurse -ErrorAction SilentlyContinue |
Where-Object { -not ($approved | ForEach-Object { $_.FullName -match $_ }) } |
Select-Object FullName, LastWriteTime
}
# 4) Verify RDP is not exposed and NLA is enforced on member servers
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' |
Select-Object fDenyTSConnections
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' |
Select-Object UserAuthentication, SecurityLayer
Remediation and Defensive Priorities
There is no patch to apply here — the remediation is programmatic. Based on the breach profiles represented by these two incidents, prioritize the following:
For covered entities working with PBMs and other data aggregators:
- Inventory your data flows. Know exactly which business associates hold your members' PHI, in what volume, and under what retention terms. You cannot assess notification obligations or downstream risk without this map.
- Enforce BAAs with teeth. Your agreements should mandate breach notification timelines well inside HIPAA's 60-day ceiling (30 days is increasingly standard), security control attestations (MFA everywhere, EDR coverage, encryption at rest/in transit), and the right to audit or receive independent assessments (SOC 2 Type II, HITRUST).
- Prepare for third-party breach response. Your IR retainer and communication plan must cover incidents that originate at a vendor. When a PBM discloses, your patients, regulators, and possibly state attorneys general will come to you. OCR reporting obligations under 45 CFR § 164.408 (breaches affecting 500+ individuals) land on the covered entity's radar regardless of where the intrusion occurred.
- Segment vendor access. Any vendor with standing network or EHR access should be behind dedicated, monitored, least-privilege pathways — not flat VPN access.
For specialty and small-to-midsize practices:
- MFA on everything externally reachable — Microsoft 365, remote access, EHR portals. Credential phishing remains the dominant initial vector against practices of this size.
- Eliminate exposed RDP and put VPN appliances on an aggressive patching cadence; these devices are routinely exploited within days of vulnerability disclosure.
- Deploy EDR with managed monitoring. Small practices cannot staff a SOC — this is precisely where an MDR service earns its cost. The detection rules above assume telemetry that only exists if EDR and log forwarding are in place.
- Test your backups against ransomware, and rehearse the breach-notification decision tree: forensics scoping, counsel engagement, OCR and state notification thresholds, and patient communication.
For affected individuals' data already in circulation:
Monitor for downstream misuse — prescription data is leveraged in highly convincing medical phishing and insurance fraud. If your members are notified, stand up call-center scripts and fraud-reporting channels proactively.
The Bottom Line
The MedImpact and Rosch Visionary Systems disclosures are not anomalies; they are the continuing shape of healthcare breach risk in 2026 — concentrated vendor data stores on one side, under-resourced specialty providers on the other. Defenders should treat every business associate as an extension of their own attack surface and every specialty practice as a target that threat actors already have on their lists. If you cannot answer "who holds our patients' data, and how would we know if it was accessed?" — that is your gap to close this quarter.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.