ProxyCare, Oscar Health, and AccentCare Breaches: Defending Against Healthcare Data Exfiltration

Introduction

The healthcare sector remains the premier target for cybercriminals seeking high-value Protected Health Information (PHI). Recent announcements from ProxyCare (Florida), Oscar Health (New York), and AccentCare (Texas) confirm a troubling trend of unauthorized access and data disclosure incidents. While the specific attack vectors in these individual cases are still being unraveled, the outcome is consistent: large volumes of sensitive patient data have been compromised. For defenders, this is not just a compliance issue; it is a signal to audit perimeter defenses, validate identity controls, and hunt for active data staging or exfiltration within their environments.

Technical Analysis

These incidents are categorized as Unauthorized Access/Disclosure events. In the healthcare context, this often results from:

1. Credential Theft: Phishing campaigns targeting administrative staff to gain initial access to Email (O365) or Electronic Health Record (EHR) portals.
2. Third-Party Exposure: Compromise of vendor credentials providing external access to internal networks (a common risk in home healthcare and managed services).
3. Network Misconfigurations: Exposed RDP or VPN services susceptible to brute-force attacks.

Affected Platforms: While specific CVEs have not been publicly attributed to these announcements, the impacted infrastructure typically includes:

• Microsoft 365 / Exchange Online: Primary vector for initial access and data theft.
• EHR Systems: Target databases containing structured PHI.
• File Transfer Servers: (e.g., GoAnywhere MFT, Accellion) historically linked to healthcare breaches.

Exploitation Status: Confirmed active exploitation resulting in data disclosure.

Detection & Response

Defenders must assume that valid credentials may be in use. Detection efforts should focus on identifying data aggregation (staging) and unusual egress patterns.

SIGMA Rules

---
title: Potential Data Staging via PowerShell Compression
id: 8c4f8e31-1a2c-4b3c-9d5e-6f7g8h9i0j1k
status: experimental
description: Detects the use of PowerShell to compress large amounts of data, a common tactic prior to data exfiltration in breach scenarios.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Compress-Archive'
      - 'System.IO.Compression.ZipFile'
  condition: selection
falsepositives:
  - Legitimate administrative backup tasks
level: medium
---
title: Suspicious Office Applications Spawning PowerShell
id: 9d5g9h0i1j2k3l4m5n6o7p8q9r0s1t2
status: experimental
description: Detects Microsoft Office applications launching PowerShell, often indicative of macro-based phishing leading to data theft.
references:
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
  selection_child:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'DownloadString'
  condition: all of selection_*
falsepositives:
  - Rare legitimate automation workflows
level: high

KQL (Microsoft Sentinel / Defender)

// Hunt for unusual volume of data access or export attempts
// Focus on IdentityInfo and AuditLogs for O365
IdentityInfo
| where AssignedRoles has_any ("Global Administrator", "Security Administrator", "Exchange Administrator")
| join kind=inner (SigninLogs
  | where RiskLevelDuringSignIn == "high"
  | project UserPrincipalName, RiskLevelDuringSignIn, DeviceDetail, Location)
  on $left.UserPrincipalName == $right.UserPrincipalName
| project UserPrincipalName, AssignedRoles, RiskLevelDuringSignIn, DeviceDetail, Location, Timestamp

Velociraptor VQL

-- Hunt for established network connections from PowerShell
-- indicating potential C2 or Data Exfiltration
SELECT Pid, Name, CommandLine, RemoteAddr, RemotePort, State
FROM process_pslist(pids=netstat().Pid)
WHERE Name =~ 'powershell.exe'
  AND State =~ 'ESTABLISHED'
  AND RemotePort NOT IN (80, 443)

Remediation Script (PowerShell)

# Audit Active Directory for users with Password Never Set or non-expiring passwords
# Common weakness leveraged in credential-based breaches.
Get-ADUser -Filter {Enabled -eq $true -and PasswordNeverExpires -eq $true} |
Select-Object Name, SamAccountName, UserPrincipalName, PasswordNeverExpires |
Export-Csv -Path "C:\Temp\PasswordPolicyAudit.csv" -NoTypeInformation

Write-Host "Audit complete. Review C:\Temp\PasswordPolicyAudit.csv for policy violations."

Remediation

1. Immediate Credential Reset: Force a password reset for all users with access to PHI systems, particularly those identified in the breach notification scope.
2. Enable MFA Strictly: Ensure Multi-Factor Authentication (MFA) is enforced for all administrative and remote access accounts. If available, enable "Number matching" in Microsoft Authenticator to prevent MFA fatigue attacks.
3. Audit Third-Party Access: Review and revoke unnecessary access for vendor accounts. Ensure all external access utilizes Privileged Access Workstations (PAWs) and Just-In-Time (JIT) access policies.
4. Review DLP Policies: Update Data Loss Prevention (DLP) rules in Microsoft Purview or equivalent to detect and block unauthorized transmission of sensitive medical record codes (ICD-10) or SSNs.
5. Patient Notification: Follow HHS/OCR breach notification requirements (typically within 60 days of discovery) if your organization was impacted by these vendors or similar incidents.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub