Minnesota Epilepsy Group Hit by Second 2026 Cyberattack: Healthcare Breach Detection and Hardening Guide

Minnesota Epilepsy Group, P.A. — a Level 4 Epilepsy Center based in Roseville, Minnesota — has disclosed that it fell victim to a cyberattack in 2026, marking the second time the organization has been breached this year. According to reporting by The HIPAA Journal, the incident follows an earlier 2026 compromise, placing the specialty practice in the unenviable position of managing two reportable healthcare data breaches within months of each other.

For defenders, the recurrence matters more than the headline. A second breach in the same calendar year is rarely bad luck — it is a signal. It typically indicates one of three conditions: (1) the initial intrusion was never fully eradicated and the attacker retained persistence, (2) a systemic architectural weakness (flat network, shared credentials, unmanaged endpoints) was never remediated, or (3) the organization is being deliberately re-targeted because the first engagement proved profitable and resistance was low. Specialty clinics like epilepsy centers are high-value targets precisely because they hold dense longitudinal ePHI — neurodiagnostic records, imaging, medication histories, and frequently minor patient data — while operating with small IT staffs and legacy clinical systems.

If you operate or defend a specialty healthcare practice, this incident is your tabletop scenario made real. This post breaks down the defensive lessons, provides detection content for the most probable intrusion mechanics, and lays out a remediation roadmap aligned to HIPAA Security Rule obligations.

Technical Analysis

What We Know

Victim: Minnesota Epilepsy Group, P.A., a Level 4 Epilepsy Center (the highest designation from the National Association of Epilepsy Centers), Roseville, MN
Incident: Second disclosed cyberattack in 2026; details reported via The HIPAA Journal breach coverage
Data at risk: As a specialty medical practice, the breach surface almost certainly includes electronic protected health information (ePHI) — patient demographics, diagnoses, EEG/neuroimaging records, treatment plans, and potentially insurance and Social Security data used in billing
Regulatory exposure: Breaches affecting 500+ individuals trigger HHS Office for Civil Rights (OCR) notification, media disclosure, and posting on the OCR "wall of shame." A second breach in one year dramatically increases the likelihood of an OCR compliance review and potential civil monetary penalties.

Why Repeat Compromises Happen in Healthcare

No CVE has been publicly attributed to this incident, and we will not speculate on a specific exploit. Instead, practitioners should understand the mechanics of recurrence, because they are consistent across the repeat-breach cases we have worked in DFIR:

Incomplete eradication. The first IR engagement scoped the visible intrusion — a ransomware detonation or a discovered mailbox compromise — but missed secondary persistence: a webshell on an externally facing appliance, a rogue service account, a scheduled task on a domain-joined server, or an OAuth grant in Microsoft 365. The attacker waits out the remediation and re-establishes access.
Credential exposure not reset comprehensively. If the first breach involved credential theft (common via infostealers or NTDS.dit exfiltration), and the organization reset only the accounts it knew were compromised, every unre reset service account, local admin, and cached Kerberos credential remains an open door.
The initial access vector was never closed. Exposed RDP, an unpatched VPN concentrator, a phishable identity posture without phishing-resistant MFA — if the front door stays open, attackers walk back through it.
Double-extortion economics. Healthcare remains a top ransomware and extortion target. Groups that exfiltrated data in attack one may return, or sell access to affiliates who attack again.

Probable Attack Chain (Defender's Model)

For a small-to-midsize specialty practice, the most probable intrusion chain consistent with incidents of this profile is:

Initial Access → phishing or credential stuffing against Microsoft 365 / remote access → Execution & Persistence → mailbox rules, rogue admin accounts, or endpoint implants → Discovery & Collection → enumeration of file shares hosting ePHI exports, billing databases, and scanned documents → Staging → compression of patient data into archives → Exfiltration → outbound transfer to attacker-controlled cloud storage or VPS infrastructure → Extortion or resale.

The detection content below targets the highest-fidelity behaviors in that chain — the ones a lean healthcare IT environment can actually instrument.

Detection & Response

The following detections assume a typical small-practice stack: Windows endpoints, Microsoft 365, and Sysmon or Defender telemetry forwarded to a SIEM. They are tuned to the behaviors most consistently observed in healthcare ePHI exfiltration and ransomware precursor activity — the threats most consistent with repeat breaches of this profile.

Sigma Rules

YAML

---
title: Mass Archive Creation of Patient Data Staging Directories
id: 3f8a2c91-4b7e-4d12-a9f5-6e2c8d1b7a30
status: experimental
description: Detects compression tools creating archives in directories commonly used to stage exfiltrated ePHI (programdata, temp, user profile roots). Consistent with pre-exfiltration staging observed in healthcare double-extortion intrusions.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winzip.exe'
      - '\tar.exe'
  selection_args:
    CommandLine|contains:
      - ' a '
      - ' -p'
  selection_paths:
    CommandLine|contains:
      - '\programdata\'
      - '\users\public\'
      - 'appdata\local\temp'
      - '\windows\temp\'
  condition: selection_tool and selection_args and selection_paths
falsepositives:
  - IT staff performing scheduled backups (restrict scope by excluding known backup service accounts)
level: high
---
title: Cloud Sync or Exfiltration Tool Execution on Clinical Workstations
id: 8c1d5e72-9a34-4f68-b217-0d4e6a3c9b51
status: experimental
description: Detects execution of rclone, MEGAcmd, or similar sync/exfiltration utilities on endpoints. These tools have no legitimate role on clinical workstations and are heavily used for ePHI exfiltration in healthcare breaches.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\MEGAsync.exe'
      - '\winscp.exe'
      - '\filezilla.exe'
      - '\curl.exe'
  condition: selection
falsepositives:
  - Managed file transfer tools deployed by billing vendors (whitelist by hash and signer, never by path alone)
level: high
---
title: Inbox Rule Hiding or Forwarding Mail Indicating Mailbox Compromise
id: 5b2e9f40-1c68-4d83-a704-8f1b3d6e2c94
status: experimental
description: Detects creation of Microsoft 365 inbox rules that delete, hide, or externally forward mail — a hallmark of business email compromise used to intercept billing conversations and harvest patient data from mailboxes.
references:
  - https://attack.mitre.org/techniques/T1114/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1114.003
logsource:
  product: office365
  service: exchange
detection:
  selection_operation:
    Operation:
      - 'New-InboxRule'
      - 'Set-InboxRule'
  selection_params:
    Parameters|contains:
      - 'DeleteMessage'
      - 'ForwardTo'
      - 'ForwardAsAttachmentTo'
      - 'RedirectTo'
      - 'MoveToFolder'
  condition: selection_operation and selection_params
falsepositives:
  - User-created forwarding rules (investigate all external forwarding; HIPAA-covered entities should prohibit auto-forwarding to external domains by policy)
level: high

KQL — Microsoft Sentinel / Defender Hunt

This query hunts for the convergence of archive staging and suspicious outbound transfers — the pre-exfiltration pattern most relevant to ePHI theft on clinical endpoints.

KQL — Microsoft Sentinel / Defender

// Hunt: archive staging + rare outbound transfers on healthcare endpoints
let ArchiveActivity =
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("rar.exe", "7z.exe", "7za.exe", "tar.exe")
   and ProcessCommandLine has_any (" a ", " -p")
| project StagingTime=TimeGenerated, DeviceName, AccountName, StagingCmd=ProcessCommandLine;
let ExfilTools =
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("rclone.exe", "megacmd.exe", "megasync.exe", "winscp.exe", "curl.exe")
| project ExfilTime=TimeGenerated, DeviceName, AccountName, ExfilCmd=ProcessCommandLine;
let LargeOutbound =
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| summarize TotalConnections=count(), DistinctRemoteIPs=dcount(RemoteIP), RemoteIPs=make_set(RemoteIP, 5) by DeviceName, InitiatingProcessFileName
| where DistinctRemoteIPs > 20 or InitiatingProcessFileName in~ ("rclone.exe", "megacmd.exe", "powershell.exe", "curl.exe");
ArchiveActivity
| join kind=inner ExfilTools on DeviceName
| join kind=inner LargeOutbound on DeviceName
| project DeviceName, AccountName, StagingTime, StagingCmd, ExfilTime, ExfilCmd, DistinctRemoteIPs, RemoteIPs
| order by StagingTime desc;
// Secondary: M365 suspicious inbox rule creation (requires OfficeActivity table)
OfficeActivity
| where TimeGenerated > ago(14d)
| where Operation in~ ("New-InboxRule", "Set-InboxRule")
| where Parameters has_any ("DeleteMessage", "ForwardTo", "RedirectTo", "ForwardAsAttachmentTo")
| project TimeGenerated, UserId, ClientIP, Operation, Parameters
| order by TimeGenerated desc;

Velociraptor VQL — Endpoint Hunt Artifact

Use this artifact across clinical workstations and file servers to identify staging archives and exfiltration tooling in one sweep.

VQL — Velociraptor

-- Healthcare ePHI staging and exfiltration hunt
-- Identifies recent archives in staging paths AND exfil tools on the same host
SELECT * FROM foreach(
row={
   SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
   FROM pslist()
   WHERE Exe =~ '(?i)(rclone|megacmd|megasync|winscp|filezilla|curl)\.exe$'
      OR CommandLine =~ '(?i)(rar|7z[a]?).exe.* a .*(-p|programdata|users\\\\public)'
},
query={
   SELECT FullPath, Size, Mtime
   FROM glob(globs=[
      'C:/ProgramData/**/*.zip',
      'C:/ProgramData/**/*.rar',
      'C:/ProgramData/**/*.7z',
      'C:/Users/Public/**/*.{zip,rar,7z}',
      'C:/Windows/Temp/**/*.{zip,rar,7z}'
   ])
   WHERE Mtime > now() - 1209600  -- archives modified in last 14 days
     AND Size > 10485760           -- larger than 10MB suggests data aggregation
})

Verification & Hardening Script

Run this PowerShell audit on domain controllers and file servers to validate post-incident eradication — directly addressing the "incomplete cleanup" failure mode behind repeat breaches. It inventories persistence surfaces and high-risk configurations.

PowerShell

# Post-Incident Eradication Audit — run elevated on DCs, file servers, and gateways
# Goal: find residual persistence and unclosed access vectors after a breach

$Report = @()

# 1. Scheduled tasks running from suspicious paths (residual persistence)
$Report += Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'appdata|programdata|users\\public|temp' -and
    $_.Principal.UserId -notmatch 'SYSTEM|NETWORK SERVICE'
} | Select-Object TaskName, TaskPath, @{N='Action';E={$_.Actions.Execute}}

# 2. Local admin group membership drift (rogue accounts from prior intrusion)
$Report += Get-LocalGroupMember -Group 'Administrators' |
    Where-Object { $_.ObjectClass -eq 'User' } |
    Select-Object Name, PrincipalSource

# 3. Recently created user accounts (within breach window — adjust -Days)
$Report += Get-LocalUser | Where-Object {
    $_.PasswordLastSet -gt (Get-Date).AddDays(-90)
} | Select-Object Name, Enabled, PasswordLastSet, LastLogon

# 4. Services pointing to non-standard binaries
$Report += Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'appdata|programdata|users\\public' -and
    $_.PathName -notmatch 'OneDrive|Teams'
} | Select-Object Name, State, StartName, PathName

# 5. Exposed RDP check — the most common re-entry vector
$RdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$RdpNla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$Report += [PSCustomObject]@{
    Name = "RDP_Enabled=$RdpEnabled | NLA_Required=$($RdpNla -eq 1)"
}

$Report | Format-List | Out-File "C:\eradication-audit-$(Get-Date -Format 'yyyyMMdd').txt"
Write-Host "Audit written to C:\eradication-audit-$(Get-Date -Format 'yyyyMMdd').txt — investigate every hit before declaring eradication."

Remediation

Because no CVE has been attributed to this incident, remediation here is architectural and procedural — the work that actually prevents a second breach:

Assume incomplete eradication from breach one. If your organization suffered an earlier incident, commission an independent threat hunt (not the same firm that did the first IR) scoped to persistence mechanisms: scheduled tasks, services, run keys, M365 OAuth grants, inbox rules, and externally facing appliances. Eradication must be verified, not assumed.
Reset credentials comprehensively — twice. After any confirmed intrusion, reset all user, service, and local admin credentials, then force a second krbtgt reset (with appropriate interval) and invalidate all Kerberos tickets and M365 refresh tokens. Partial resets are the single most common reason attackers walk back in.
Close the initial access vector. Disable internet-exposed RDP outright; require VPN with phishing-resistant MFA (FIDO2/passkeys) for all remote access. Audit and patch perimeter appliances — VPN concentrators, firewalls, and remote access gateways remain the dominant initial access vector for healthcare intrusions in 2025–2026.
Enforce M365 hardening. Block legacy authentication, disable external auto-forwarding of mail, alert on all inbox rule creation, and review third-party OAuth application consents. BEC-adjacent mailbox compromise is a recurring path to ePHI exposure in small practices.
Segment clinical systems. EHR front-ends, imaging/neurodiagnostic devices, and billing systems must not share a flat network with general office workstations. Flat networks are why a single phished workstation becomes a practice-wide ePHI breach.
Meet HIPAA breach obligations on schedule. Notify affected individuals without unreasonable delay (no later than 60 days from discovery), notify HHS OCR, and — for breaches affecting 500+ residents of a state — notify prominent media. Document your risk assessment of what data was actually accessed; "cannot rule out access" still drives notification duties.
Treat a repeat breach as an OCR audit trigger. A second reportable breach in one year materially raises the probability of an OCR compliance investigation. Get ahead of it: refresh your Security Risk Analysis, remediate documented gaps, and evidence workforce training — these are the first artifacts OCR requests.
Deploy managed detection with 24/7 monitoring. Specialty practices cannot staff a SOC internally. An MDR/SOC partner watching endpoint, identity, and M365 telemetry is the difference between catching an intrusion at the staging phase and reading about yourself on a breach notification site.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub