OneTouchPoint Data Breach Settlement: Ransomware Defense Lessons for Healthcare Third-Party Vendors

OneTouchPoint Corp., a Wisconsin-based mailing and printing vendor serving healthcare organizations, has agreed to a multi-million dollar settlement resolving class action litigation stemming from a 2022 encryption-based cyberattack. The incident — a ransomware-style intrusion that encrypted systems and exposed protected health information (PHI) belonging to the vendor's healthcare clients — is a textbook case study in third-party risk materializing into regulatory, legal, and financial consequence.

For defenders, the settlement itself is not the story. The story is that a business associate in the healthcare supply chain was compromised by an encryption-based attack, patient data walked out the door, and the financial fallout is still being settled years later. If your organization shares PHI with print vendors, mailing houses, billing services, or any downstream processor, this incident is your risk profile. Ransomware operators continue to prioritize healthcare-adjacent vendors in 2025 and 2026 precisely because they are soft targets holding regulated data with high leverage for extortion.

This post breaks down the attack pattern, what defenders should hunt for, and how to harden both your environment and your vendor governance program against the same outcome.

Technical Analysis

What Happened

OneTouchPoint disclosed a 2022 security incident in which an unauthorized actor gained access to its network and deployed encryption-based malware — consistent with a ransomware or ransomware-adjacent intrusion. The vendor provides printing and mailing services to healthcare entities, meaning it stores and processes names, addresses, dates of birth, and in many cases clinical or insurance-related identifiers on behalf of covered entities. That data was exposed as a result of the intrusion, triggering HIPAA breach notification obligations, class action litigation, and now a multi-million dollar settlement.

No CVE is associated with this incident — it was an intrusion campaign, not a single software flaw. Based on the described "encryption-based" attack pattern, the kill chain almost certainly followed the standard ransomware playbook observed across healthcare vendor compromises in the last 24 months:

1. Initial access — typically exposed remote services (RDP/VPN without MFA), phishing-delivered loaders, or exploitation of an internet-facing appliance.
2. Persistence and credential theft — dumping LSASS memory, harvesting cached domain credentials, and deploying web shells or RMM tooling (AnyDesk, ScreenConnect, Atera) as backup access.
3. Lateral movement — SMB/WMI/PsExec-style pivoting to file servers and backup infrastructure.
4. Defense evasion — deleting Volume Shadow Copies (vssadmin delete shadows), disabling backup agents, and tampering with endpoint security.
5. Impact — mass file encryption across shared drives and servers, often preceded by data exfiltration for double extortion.

Why This Attack Pattern Is Still Active in 2026

Healthcare business associates remain a top ransomware target class. The economics are straightforward: these vendors aggregate PHI from multiple covered entities, frequently run lean security programs, and face enormous contractual and regulatory pressure to restore operations quickly — making them likely to pay. Every defender supporting a healthcare environment should treat this intrusion pattern as a current, active threat, not a 2022 historical footnote.

Exploitation Status

The techniques described — shadow copy deletion, mass encryption, RMM abuse, and credential dumping — are actively used in the wild today by multiple ransomware affiliates and initial access brokers. These behaviors are well represented in the CISA Known Exploited Vulnerabilities ecosystem as post-exploitation activity and map directly to MITRE ATT&CK techniques T1490 (Inhibit System Recovery), T1486 (Data Encrypted for Impact), T1003 (OS Credential Dumping), and T1219 (Remote Access Software).

Detection & Response

The detections below target the behaviors that define an encryption-based intrusion like the OneTouchPoint attack. They are tuned to fire on high-confidence ransomware precursor activity, not ambient noise.

Sigma Rules

---
title: Volume Shadow Copy Deletion via Vssadmin or WMIC
id: 8b2f4a17-3c6d-4e9a-b512-7f9d2e4c6a01
status: experimental
description: Detects deletion of Volume Shadow Copies, a hallmark ransomware precursor behavior used to inhibit system recovery before mass encryption, as seen in the OneTouchPoint intrusion pattern.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.hipaajournal.com/onetouchpoint-data-breach-settlement/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'delete catalog'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate backup maintenance scripts (rare; validate against change windows)
  - IT administrators resizing shadow storage
level: high
---
title: Mass File Renaming Indicative of Ransomware Encryption
id: 2d7c9e54-1a8b-4f36-c984-3b5e7a2d9f10
status: experimental
description: Detects high-volume file modification events consistent with ransomware mass encryption activity targeting file servers and shared drives, the impact stage of encryption-based attacks like the OneTouchPoint incident.
references:
  - https://attack.mitre.org/techniques/T1486/
  - https://www.hipaajournal.com/onetouchpoint-data-breach-settlement/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_rename
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '.locked'
      - '.encrypted'
      - '.crypt'
      - 'RECOVER-FILES'
      - 'HOW_TO_DECRYPT'
      - 'README_FOR_DECRYPT'
  filter_legit:
    SourceImage|endswith:
      - '\explorer.exe'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate file archiving tools (uncommon with these extensions)
  - DLP or DRM agents renaming protected files
level: critical
---
title: Unauthorized Remote Access Tool Execution
id: 5f1a8c63-9d24-4b7e-a138-6c2e5f8b4d72
status: experimental
description: Detects execution of commonly abused remote monitoring and management (RMM) tools used by ransomware operators for persistence and hands-on-keyboard access during intrusions against healthcare vendors.
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://www.hipaajournal.com/onetouchpoint-data-breach-settlement/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\anydesk.exe'
      - '\screenconnect.client.exe'
      - '\atera_agent.exe'
      - '\splashtop.exe'
      - '\teamviewer.exe'
      - '\ngrok.exe'
      - '\rustdesk.exe'
  filter_paths:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection and not filter_paths
falsepositives:
  - Sanctioned IT RMM tooling (whitelist approved publisher paths and hashes)
  - Help desk remote support sessions
level: medium

KQL — Microsoft Sentinel / Defender

The following hunt queries correlate shadow copy deletion with subsequent mass file modification — the sequence that distinguishes ransomware impact from isolated admin activity. The second query hunts unsanctioned RMM execution across the estate, a common persistence mechanism in vendor-network intrusions.

// Correlate shadow copy deletion with ransomware precursor behavior over 24 hours
let ShadowDelete = DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe", "wbadmin.exe")
| where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "delete catalog")
| project DeviceName, AccountName, ShadowDeleteTime=TimeGenerated, ProcessCommandLine;
ShadowDelete
| join kind=inner (
    DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where ActionType == "FileRenamed" or ActionType == "FileModified"
    | summarize FileOps=count() by DeviceName
    | where FileOps > 500
) on DeviceName
| project DeviceName, AccountName, ShadowDeleteTime, ProcessCommandLine, FileOps
| sort by FileOps desc;

// Hunt for unsanctioned RMM tool execution outside approved install paths
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("anydesk.exe", "screenconnect.client.exe", "atera_agent.exe", "splashtop.exe", "teamviewer.exe", "rustdesk.exe", "ngrok.exe")
| where FolderPath !startswith "C:\\Program Files"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Executions=count()
  by DeviceName, FileName, FolderPath, AccountName
| sort by FirstSeen desc;

Velociraptor VQL

This hunt artifact sweeps endpoints for ransomware precursor indicators: shadow copy state, suspicious RMM binaries outside sanctioned paths, and ransom-note artifacts on user-writable shares.

-- Hunt ransomware precursor artifacts: RMM tools in user/temp paths and ransom notes
LET proc_hunt = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(anydesk|screenconnect|atera|splashtop|rustdesk|ngrok|teamviewer)'
  AND Exe !~ '(?i)Program Files'

LET note_hunt = SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/Desktop/**DECRYPT*.txt', accessor='ntfs')

SELECT * FROM proc_hunt
UNION ALL
SELECT NULL AS Pid, 'RANSOM_NOTE_ARTIFACT' AS Name, FullPath AS CommandLine,
       FullPath AS Exe, NULL AS Username, Mtime AS CreateTime
FROM note_hunt

Verification and Hardening Script

Run this PowerShell on Windows servers — especially file servers and backup hosts — to verify shadow copies are intact, confirm ransomware-relevant hardening, and flag unauthorized RMM tooling. This is a read-only audit suitable for scheduled execution across a vendor or client estate.

# --- Verify Volume Shadow Copies exist and are healthy ---
Write-Host "=== Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize
} else {
    Write-Warning "NO shadow copies found — recovery capability may be degraded. Investigate immediately."
}

# --- Check for recent shadow deletion events (Event ID 524 / 33 from VSS) ---
Write-Host "=== Recent VSS Deletion Events (last 7 days) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'delete shadows|shadow copies.*deleted' } |
    Select-Object TimeCreated, Id, Message | Format-List

# --- Audit for unauthorized RMM tooling outside Program Files ---
Write-Host "=== Unauthorized RMM Tool Sweep ===" -ForegroundColor Cyan
$rmmPattern = 'anydesk|screenconnect|atera|splashtop|rustdesk|ngrok'
$searchPaths = @("$env:TEMP", "C:\Users\Public", "C:\ProgramData")
foreach ($path in $searchPaths) {
    Get-ChildItem -Path $path -Recurse -Include *.exe -ErrorAction SilentlyContinue |
        Where-Object { $_.Name -match $rmmPattern } |
        Select-Object FullName, LastWriteTime
}

# --- Verify controlled folder access (ransomware protection) status ---
Write-Host "=== Controlled Folder Access Status ===" -ForegroundColor Cyan
$cfa = Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess -ErrorAction SilentlyContinue
switch ($cfa) {
    1 { Write-Host "Controlled Folder Access: ENABLED" -ForegroundColor Green }
    2 { Write-Host "Controlled Folder Access: AUDIT MODE — consider enforcing" -ForegroundColor Yellow }
    default { Write-Warning "Controlled Folder Access: DISABLED — enable on file servers handling PHI" }
}

# --- Confirm SMBv1 is disabled (lateral movement reduction) ---
Write-Host "=== SMBv1 Status ===" -ForegroundColor Cyan
$smb1 = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue
if ($smb1.State -ne 'Disabled') {
    Write-Warning "SMBv1 is enabled. Disable with: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol"
} else {
    Write-Host "SMBv1: Disabled" -ForegroundColor Green
}

Remediation

There is no patch for a settlement — but there are concrete, prioritized actions that prevent your organization from becoming the next OneTouchPoint headline.

Immediate technical actions (0–30 days):

1. Enforce MFA on all remote access — VPN, RDP gateways, and third-party support channels. Unauthenticated remote services remain the dominant initial access vector in healthcare vendor breaches.
2. Protect backup and recovery infrastructure — move backups to immutable or air-gapped storage, restrict vssadmin/backup console access to dedicated admin accounts, and alert on any shadow copy deletion.
3. Inventory and whitelist RMM tooling — block execution of remote access software from non-sanctioned paths via AppLocker or WDAC. RMM abuse is the persistence mechanism of choice for hands-on-keyboard intrusions.
4. Enable Controlled Folder Access (or equivalent EDR tamper protection) on file servers hosting PHI, starting in audit mode and moving to enforcement.
5. Deploy the detections above and validate them with a controlled simulation (e.g., an atomic test of vssadmin delete shadows on a sacrificial host).

Third-party risk program actions (30–90 days):

6. Re-tier your business associates. Any vendor storing or transmitting PHI — printers, mailers, billing firms, shredding services — should be classified as high-risk and subject to annual security assessment, not just a signed BAA.
7. Contract for security controls and notification SLAs. BAAs should specify encryption at rest, MFA, EDR coverage, breach notification within 24–72 hours, and the right to audit or receive independent attestations (SOC 2 Type II, HITRUST).
8. Minimize data shared. The OneTouchPoint breach exposed data because the vendor held it. Apply data minimization: transmit only what the vendor operationally requires, and require verifiable destruction after job completion.
9. Include vendor compromise in IR tabletop exercises. Your IR plan should have a playbook for a business associate breach: who notifies HHS OCR, who handles state attorney general notification, who manages patient communication, and how litigation hold is executed.

Regulatory note: Breaches affecting 500 or more individuals require notification to HHS OCR within 60 days under the HIPAA Breach Notification Rule, plus media notification. State breach statutes may impose shorter windows. The class action exposure demonstrated here — a multi-million dollar settlement on top of regulatory and remediation costs — is the financial baseline your board should use when evaluating vendor security investment.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub