Mid Florida Dermatology Data Breach: 85K Patients Exposed — Healthcare Detection and Response Playbook

Mid Florida Dermatology & Plastic Surgery has disclosed a data breach affecting approximately 85,000 patients, joining Kannarr Eye Care in Kansas and Indiana University in a fresh wave of healthcare sector incidents reported by The HIPAA Journal. For a specialty practice of this size, 85,000 records represents essentially the entire active patient population — names, contact details, clinical histories, and in dermatology/plastic surgery contexts, potentially highly sensitive treatment photographs and procedure records.

This is not an anomaly. It is the pattern. Ambulatory specialty clinics — dermatology, ophthalmology, dental, plastics — sit in the crosshairs of extortion-driven threat actors precisely because they hold dense, monetizable PHI while typically operating with a fraction of the security maturity of a hospital system. No dedicated SOC. Often no full-time security staff. EHR platforms managed by small MSPs. Flat networks where the front-desk workstation is one hop away from the patient database.

If you defend a healthcare organization — or you are the MSSP responsible for one — this post is your playbook: how these breaches typically unfold, what you can actually detect before exfiltration completes, and the remediation steps that matter.

Technical Analysis

What We Know

Per the HIPAA Journal reporting, Mid Florida Dermatology & Plastic Surgery notified roughly 85,000 patients of a breach involving unauthorized access to its systems. Kannarr Eye Care (Kansas) and Indiana University disclosed separate incidents in the same reporting cycle. While the specific intrusion vector for the Mid Florida Dermatology incident has not been publicly attributed to a particular vulnerability or CVE as of this writing, the anatomy of specialty-clinic breaches is well established across hundreds of OCR breach portal investigations:

• Initial access: Phishing against front-office staff, compromised remote access (exposed RDP, unpatched VPN appliances), or credential stuffing against webmail/patient portals.
• Discovery and staging: Attackers enumerate shared drives, identify EHR databases, billing systems, and exported patient reports. Data is staged into archives on a server or workstation.
• Exfiltration: Bulk transfer to actor-controlled infrastructure — frequently over HTTPS to cloud storage (MEGA, Dropbox, OneDrive, or attacker VPS), or via the RMM tool the attacker installed or abused.
• Extortion: Double-extortion playbook. In 2025–2026 healthcare incidents, actors increasingly skip encryption entirely and move straight to data-leak threats, which means your ransomware detection never fires.

Why Specialty Clinics Are the Soft Target

From 15 years of IR work in this sector, the recurring failures are consistent:

1. Flat network architecture. Clinical workstations, imaging devices, EHR servers, and guest Wi-Fi share broadcast domains. One phished MA (medical assistant) credential equals domain-wide reach.
2. No egress monitoring. Outbound traffic is rarely baselined. A 40 GB archive leaving on a Saturday night looks identical to normal traffic because nobody defined normal.
3. Shared/local admin credentials. MSPs push one local admin password across the fleet for convenience. Lateral movement becomes trivial.
4. EHR audit logs that nobody reads. Most EHR/PM platforms (eClinicalWorks, NextGen, ModMed, athenahealth) log record access — but mass-export events are never alerted on.
5. PHI scattered outside the EHR. Exported CSV reports, scanned insurance cards, and clinical photos sitting on general-purpose file shares with Everyone:Read.

Exploitation Status

No CVE is associated with this disclosure, and no specific threat actor has claimed responsibility publicly at the time of writing. The defensive lesson is therefore technique-driven, not vulnerability-driven: the detection content below targets the universal behaviors of PHI theft — mass access, staging, and exfiltration — which are observable regardless of the initial access vector.

Detection & Response

The rules and queries below are built for the telemetry a small-to-midsize healthcare environment realistically has: Windows event logs (Sysmon or native auditing), Defender for Endpoint, and Sentinel. Each was chosen to be high-fidelity in a clinical environment, not to fire on every admin task.

SIGMA Rules

The first rule detects data staging — compression tools invoked against directories that plausibly hold patient data. In clinic environments, legitimate archive activity against paths like EHR_Export, Patients, or Billing is rare and almost always scheduled; an interactive 7z/rar invocation against these paths is a strong exfiltration precursor.

The second rule targets mass file access to PHI shares using Windows File System auditing (SACL on the share, 4663 events via Sigma's generic file_event-adjacent process/access translation — deployed here as a security log selection for environments forwarding 4663). Tune the share path to your environment; a single account touching hundreds of distinct patient files in a short window is the classic pre-exfiltration enumeration pattern. Alert on the volume threshold, which the accompanying KQL handles; the Sigma rule captures the raw access events for downstream correlation.

---
title: Archive Utility Staging Suspected Patient Data Directories
id: 3f8c2a91-7d4e-4b1a-9e6f-2c5d8a1b4f70
status: experimental
description: Detects compression/archiving tools executed against directories commonly containing exported PHI, EHR reports, or billing data — a frequent staging step before healthcare data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.hipaajournal.com/mid-florida-dermatology-plastic-surgery-data-breach/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_path:
    CommandLine|contains:
      - 'patient'
      - 'ehr'
      - 'emr'
      - 'phi'
      - 'billing'
      - 'medical_records'
      - 'export'
  condition: selection_tool and selection_path
falsepositives:
  - Scheduled EHR backup jobs (identify and whitelist by service account and parent process)
  - MSP maintenance scripts
level: high
---
title: Interactive Access to PHI File Share by Non-Clinical System Account
id: 91b4e6d2-3a7f-4c58-b2d9-8e1f6a4c7d35
status: experimental
description: Detects file access events on designated PHI shares originating from accounts not in the expected clinical/billing access baseline. Correlate with volume thresholds in Sentinel to identify mass-read enumeration preceding exfiltration.
references:
  - https://attack.mitre.org/techniques/T1213/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.collection
  - attack.t1078
logsource:
  product: windows
  service: security
detection:
  selection:
    ObjectName|contains:
      - '\PHI\'
      - '\PatientData\'
      - '\EHR_Export\'
      - '\MedicalRecords\'
    AccessMask|contains:
      - '0x1'
      - '0x80'
  filter_baseline_accounts:
    SubjectUserName|endswith:
      - '$'
  condition: selection and not filter_baseline_accounts
falsepositives:
  - Backup service accounts (whitelist explicitly by account name)
  - DLP/CASB scanning service accounts
level: medium

Deployment note for rule two: it requires Object Access auditing (SACL) enabled on your PHI shares — covered in the remediation script below. The Sigma rule is the raw signal; the actual high-fidelity alert comes from volume-based aggregation, which is the KQL query's job.

KQL — Microsoft Sentinel / Defender

This hunt surfaces mass-read enumeration of PHI shares: a single account accessing an abnormally high number of distinct files within a one-hour window. In a real clinic, a billing clerk might touch 30–80 files a day. An attacker staging a theft touches thousands in minutes.

// Mass PHI file access enumeration - potential pre-exfiltration staging
// Requires SecurityEvent 4663 (Object Access) ingestion into Sentinel
let ThresholdDistinctFiles = 200;
let Window = 1h;
SecurityEvent
| where EventID == 4663
| where ObjectName has_any ("PHI", "PatientData", "EHR_Export", "MedicalRecords", "Billing")
| where AccessMask has_any ("0x1", "0x80") // ReadData / ReadAttributes
| summarize DistinctFiles = dcount(ObjectName),
            FileSample = make_set(ObjectName, 10),
            FirstAccess = min(TimeGenerated),
            LastAccess = max(TimeGenerated)
    by SubjectUserName, SubjectDomainName, Computer, bin(TimeGenerated, Window)
| where DistinctFiles >= ThresholdDistinctFiles
| extend AccessVelocity = DistinctFiles / datetime_diff("minute", LastAccess, FirstAccess + 1min)
| project SubjectUserName, Computer, DistinctFiles, AccessVelocity, FirstAccess, LastAccess, FileSample
| order by DistinctFiles desc;

For environments where PHI resides on an application server rather than SMB shares, this companion query hunts anomalous outbound transfer volume from clinical servers — the catch that matters when actors exfiltrate quietly and never encrypt anything:

// Anomalous outbound data volume from servers hosting EHR/PHI workloads
// Baseline: servers should have stable, modest egress. Sudden multi-GB spikes = investigate.
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where DeviceName has_any ("EHR", "SQL", "APP-SRV", "FILE01") // tune to your PHI hosts
| where RemoteIPType == "Public"
| summarize TotalBytesOut = sum(BytesSent),
            Connections = count(),
            RemoteDestinations = dcount(RemoteIP),
            Destinations = make_set(RemoteUrl, 20)
    by DeviceName, bin(TimeGenerated, 1h)
| where TotalBytesOut > 500000000 // 500 MB/hour from a PHI server - tune to baseline
| order by TotalBytesOut desc;

Tune both thresholds against a two-week baseline before enabling alerting. In small clinics the baseline will be remarkably flat — which is exactly why anomalies pop.

Velociraptor VQL

When you are called in after a disclosure like Mid Florida Dermatology's, the first forensic question is: what was staged and where did it go? This artifact hunts for recently created large archives in non-standard locations across endpoints — the residue of exfiltration staging that attackers routinely forget or fail to clean up.

-- Hunt for staged archive files (potential exfiltration staging) on Windows endpoints
-- Looks for large, recently created archives outside of known backup directories
SELECT FullPath,
       Size,
       Mtime,
       Btime,
       basename(path=FullPath) AS FileName
FROM glob(globs=[
  'C:/Users/*/**.7z',
  'C:/Users/*/**.zip',
  'C:/Users/*/**.rar',
  'C:/ProgramData/**.7z',
  'C:/ProgramData/**.zip',
  'C:/Windows/Temp/**.zip',
  'C:/Windows/Temp/**.7z',
  'D:/**.zip',
  'D:/**.7z'
])
WHERE Size > 50000000  -- 50MB+: smaller archives are routine; bulk PHI staging is not
  AND Mtime > now() - 2592000  -- created/modified in the last 30 days
  AND NOT FullPath =~ '(?i)backup|veeam|shadowcopy'
ORDER BY Mtime DESC

Follow-up pivot for any hits: run netstat() and pslist() scoped to the same window as the archive's creation time to identify the process and destination that moved it.

Hardening & Verification Script

This PowerShell script does three things every specialty clinic should have done yesterday: enables Object Access auditing on PHI shares, verifies SMB signing (thwarts relay-based lateral movement), and audits local administrator group membership for the shared-credential sprawl MSPs leave behind.

# Security Arsenal - Healthcare PHI Share Hardening & Verification
# Run elevated on the file server hosting PHI shares.

# 1. Enable Object Access auditing (required for 4663 file access events)
auditpol /set /subcategory:"File System" /success:enable /failure:enable
auditpol /set /subcategory:"File Share" /success:enable /failure:enable
Write-Output "[+] Object Access auditing enabled."

# 2. Apply SACL to PHI shares so read events are actually recorded
$PhiShares = @("D:\Shares\PatientData", "D:\Shares\EHR_Export", "D:\Shares\Billing")
foreach ($share in $PhiShares) {
    if (Test-Path $share) {
        $acl = Get-Acl $share -Audit
        $auditRule = New-Object System.Security.AccessControl.FileSystemAuditRule(
            "Everyone", "ReadData,ReadAttributes", "ContainerInherit,ObjectInherit", "None", "Success")
        $acl.AddAuditRule($auditRule)
        Set-Acl $share $acl
        Write-Output "[+] Audit SACL applied to $share"
    } else {
        Write-Output "[!] Path not found, skipping: $share"
    }
}

# 3. Enforce SMB signing (mitigates NTLM relay lateral movement)
Set-SmbServerConfiguration -RequireSecuritySignature $true -EnableSecuritySignature $true -Confirm:$false
$smb = Get-SmbServerConfiguration
Write-Output "[+] SMB signing required: $($smb.RequireSecuritySignature)"

# 4. Disable SMBv1 if still present
$smbv1 = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue
if ($smbv1.State -eq "Enabled") {
    Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart -Confirm:$false
    Write-Output "[+] SMBv1 disabled (reboot required)."
} else {
    Write-Output "[+] SMBv1 already disabled or not present."
}

# 5. Audit local Administrators for shared/stale MSP accounts
$admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue
Write-Output "[*] Local Administrators on $env:COMPUTERNAME :"
$admins | ForEach-Object { Write-Output "    - $($_.Name) [$($_.ObjectClass)]" }
if (($admins | Measure-Object).Count -gt 4) {
    Write-Output "[!] WARNING: More than 4 local admins - review for shared MSP/vendor accounts."
}

# 6. Verify RDP is not exposed and NLA is enforced
$rdp = Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections
$nla = Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name UserAuthentication
Write-Output "[*] RDP disabled: $($rdp.fDenyTSConnections -eq 1) | NLA enforced: $($nla.UserAuthentication -eq 1)"
Write-Output "[*] Review complete. Forward 4663 events to your SIEM and baseline access volumes per user."

Remediation

Whether you are responding to an incident like Mid Florida Dermatology's or hardening proactively, this is the order of operations that matters:

Immediate (0–72 hours post-discovery):

1. Preserve evidence before remediation. Image affected systems, export EHR audit logs, firewall/VPN logs, and M365/Google Workspace sign-in logs. OCR investigations and breach counsel will require a defensible timeline; wiping and rebuilding first is the most common IR malpractice in small healthcare.
2. Determine the actual data scope. Do not guess from firewall logs alone. Query the EHR's native audit trail for mass-export or report-generation events, and correlate with 4663 file access events on PHI shares. The 85,000-record figure in this disclosure almost certainly came from exactly this analysis.
3. Reset credentials in the right order. Domain admin and service accounts first, then all clinical users, then patient-portal credentials if the portal backend was in scope. Enable MFA on remote access and email the same day — not next quarter.
4. Engage breach counsel early. HIPAA Breach Notification Rule (45 CFR §§ 164.400–414) requires notification to affected individuals within 60 days of discovery, to HHS OCR, and — for breaches over 500 records — to prominent media outlets. State laws (Florida's Information Protection Act, 30-day window) may be stricter than HIPAA.

Near-term (30–60 days): 5. Segment the network. Clinical devices, EHR/database servers, front-office workstations, and guest Wi-Fi belong in separate VLANs with default-deny between them. This single control converts most clinic breaches from catastrophic to contained. 6. Deploy egress monitoring with baselines. As the KQL above demonstrates, quiet exfiltration is only quiet if nobody is watching outbound volume. This is the detection gap that turns a phished mailbox into an 85,000-patient OCR report. 7. Centralize PHI. Hunt down exported CSVs, scanned documents, and clinical photos on general-purpose shares. PHI outside the EHR, on shares with broad access, is unmonitored by definition. 8. Kill shared local admin credentials. Deploy LAPS (Windows LAPS is native in current Windows 10/11 and Server builds), audit local admin groups, and hold your MSP contractually accountable for credential hygiene.

Structural (ongoing): 9. Map to a framework and measure. HIPAA Security Rule alignment plus CIS Controls IG1 is achievable even for a 20-person practice. NIST CSF 2.0's Govern function is increasingly relevant as OCR's 2024–2025 enforcement wave has punished risk-analysis failures more than the breaches themselves. 10. Tabletop the breach-notification clock. Most practices discover breaches weeks late and then burn their 60-day notification window arguing about scope. Rehearse the counsel → forensics → OCR decision tree before you need it. 11. Get eyes on glass. A small clinic cannot staff a SOC — that is the business case for an MDR provider with healthcare context, tuned specifically for the PHI-access and exfiltration behaviors above rather than generic ransomware detection.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub