Resource Center of Dallas Breach: 12,500 Patients Notified — Healthcare Detection and Hardening Playbook

The Resource Center of Dallas — a nonprofit providing health services to the North Texas LGBTQ and HIV-affected communities — has begun notifying approximately 12,500 patients that their protected health information (PHI) was exposed in a cyber incident. The notification appeared alongside breach disclosures from Kern Psychiatric Health and Wellness Center, The Asthma Center, and Integrative Health, per The HIPAA Journal's reporting.

If you run security for a community health organization, a behavioral health clinic, or a specialty practice, this is not someone else's problem. These four simultaneous disclosures are a snapshot of the current threat picture in U.S. healthcare: mid-sized and nonprofit providers with lean IT budgets, flat networks, externally exposed email and remote access, and PHI that commands premium prices on criminal markets. Attackers have correctly assessed that these organizations are softer targets than hospital systems — and the breach notification pipeline in 2026 reflects it.

Based on the reporting available, the incident follows the dominant pattern we see in healthcare breach investigations: unauthorized access to internal systems or email accounts, discovery weeks or months later, forensic review of what data resided in the compromised environment, and finally notification under HIPAA's 60-day clock. Details on the initial access vector have not been fully disclosed, but the defensive lessons do not depend on the exact vector — the same small set of failure modes accounts for the overwhelming majority of these incidents.

This post is written for the SOC analysts, IT directors, and fractional security teams defending organizations exactly like the Resource Center of Dallas. No CVE was disclosed in this incident — and none will be invented here. The value is in the detections, the hunt queries, and the hardening steps that close the doors these incidents consistently walk through.

Technical Analysis: How These Healthcare Intrusions Actually Unfold

The Typical Attack Chain

Across the healthcare breach investigations our team has led and the public record of similar incidents, the attack chain for a community-provider PHI breach almost always includes some combination of:

1. Initial access via credential compromise. Phishing against Microsoft 365 tenants remains the single most common entry point for healthcare breaches reported to HHS OCR. Email account compromise gives attackers direct access to PHI sitting in mailboxes — no malware, no exploit, no EDR alert. Legacy authentication protocols (IMAP/POP/SMTP basic auth) and absent or inconsistently enforced MFA are the enablers.
2. Persistence through mailbox manipulation. Once inside a mailbox, attackers create inbox rules to hide their tracks, auto-forward messages containing attachments or financial keywords, and delete sent items. This is one of the highest-fidelity, lowest-noise behaviors you can detect.
3. Data staging and exfiltration. When the target is file shares or EHR-adjacent systems rather than mailboxes, attackers enumerate network shares, stage PHI into compressed archives (7-Zip and WinRAR are the tools of choice), and exfiltrate over HTTPS to cloud storage or attacker-controlled infrastructure.
4. Optional extortion escalation. In a meaningful share of these incidents, the intrusion either begins as or escalates to ransomware. Behavioral health and HIV-service providers hold data that is catastrophically sensitive, which makes them prime double-extortion targets — the threat to publish is leverage independent of encryption.

Why Community Health Providers Are Disproportionately Hit

• Budget constraints mean MFA, EDR, and email security gaps persist longer than in larger systems.
• Small IT teams (often 1-5 people covering everything from help desk to network) have no 24/7 monitoring. Dwell time in healthcare breaches routinely runs weeks to months.
• High-value data: HIV status, mental health records, and substance abuse treatment records carry extra regulatory sensitivity (42 CFR Part 2) and extra extortion value.
• Vendor sprawl: billing services, transcription vendors, EHR hosts, and email providers all represent third-party access paths, and business associate compromises account for a large and growing share of healthcare breach volume.

Exploitation Status

There is no CVE associated with this incident and no confirmed zero-day. This is an operational breach — the exploitation status that matters is that credential-phishing and mailbox-compromise techniques against healthcare tenants are actively and continuously exploited in the wild and remain the top initial access vector in HIPAA breach reporting. If your detection coverage assumes an exploit or malware will fire an alert, you are blind to the most likely attack against your organization.

Detection & Response

The detections below target the highest-signal behaviors in the healthcare breach pattern: malicious inbox rule creation, data staging with archive utilities, and destructive pre-ransomware activity. They are tuned to fire on attacker behavior, not routine administration.

Sigma Rules

---
title: Suspicious Inbox Rule Created for Forwarding or Deletion
description: Detects creation of Exchange inbox rules that forward mail externally or auto-delete messages, a hallmark persistence and collection technique in business email compromise and healthcare mailbox breaches.
references:
  - https://attack.mitre.org/techniques/T1114/002/
  - https://attack.mitre.org/techniques/T1098/002/
author: Security Arsenal
status: experimental
date: 2026/02/14
tags:
  - attack.collection
  - attack.persistence
  - attack.t1114.002
  - attack.t1098.002
logsource:
  product: m365
  service: exchange
detection:
  selection_operation:
    Operation:
      - 'New-InboxRule'
      - 'Set-InboxRule'
  selection_suspicious:
    Parameters|contains:
      - 'ForwardTo'
      - 'ForwardAsAttachmentTo'
      - 'RedirectTo'
      - 'DeleteMessage'
  condition: selection_operation and selection_suspicious
falsepositives:
  - Users legitimately creating forwarding or cleanup rules (tune against known-helpdesk activity and approved external forwarding)
level: high
---
title: Archive Utility Command-Line Data Staging
description: Detects 7-Zip or WinRAR invoked via command line to create archives, consistent with PHI staging prior to exfiltration from file servers and workstations.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
status: experimental
date: 2026/02/14
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' -p'
  condition: selection_img and selection_cli
falsepositives:
  - IT backup scripts and software packaging (scope exclusions to known service accounts and scheduled tasks)
level: medium
---
title: Shadow Copy Deletion via Vssadmin or WMI
description: Detects deletion of volume shadow copies, a pre-encryption ransomware behavior observed in healthcare extortion incidents.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
status: experimental
date: 2026/02/14
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith:
      - '\wmic.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'shadowcopy delete'
      - 'Win32_ShadowCopy'
  condition: selection_vssadmin or selection_wmic
falsepositives:
  - Rare legitimate storage maintenance; treat any hit on a file server as urgent
level: critical

KQL — Microsoft Sentinel / Defender Hunt

This query hunts for command-line archive staging on devices with file-server or records-adjacent roles, correlated with unusual volume — a strong signal of PHI collection before exfiltration:

let ArchiveBins = dynamic(["7z.exe", "7za.exe", "rar.exe", "winrar.exe", "tar.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ (ArchiveBins)
| where ProcessCommandLine has_any (" a ", " -p", "u ") or ProcessCommandLine contains "-mx"
| summarize ArchiveRuns = count(),
            DistinctTargets = dcount(FolderPath),
            Commands = make_set(ProcessCommandLine, 20)
    by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 1h)
| where ArchiveRuns >= 5 or DistinctTargets >= 3
| sort by ArchiveRuns desc

For environments ingesting Microsoft 365 audit data via the OfficeActivity connector (forwarded into Log Analytics), hunt for the mailbox-rule behavior directly — the single highest-fidelity BEC signal in these incidents:

OfficeActivity
| where TimeGenerated > ago(14d)
| where Operation in~ ("New-InboxRule", "Set-InboxRule")
| extend RuleParams = tostring(Parameters)
| where RuleParams has_any ("ForwardTo", "ForwardAsAttachmentTo", "RedirectTo", "DeleteMessage")
| project TimeGenerated, UserId, ClientIP, Operation, RuleParams
| sort by TimeGenerated desc

Velociraptor VQL — Endpoint Hunt

This artifact hunts endpoints and file servers for recent archive creation in user and shared-data paths plus suspicious compression-tool execution, useful for scoping whether PHI was staged for theft:

-- Hunt for recent archive files and compression tool execution on healthcare endpoints
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(7z|7za|rar|winrar)\.exe$'
   OR CommandLine =~ '(?i)(7z|rar).*\s-a?p'

-- Locate recently created archives in common PHI staging paths (run against file servers)
SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Users/*/**/*.zip',
  'C:/Users/*/**/*.7z',
  'C:/Users/*/**/*.rar',
  'D:/Shares/**/*.7z',
  'D:/Shares/**/*.rar'
])
WHERE Mtime > now() - (14 * 24 * 3600)
   AND Size > 10000000
ORDER BY Mtime DESC

Archives larger than 10 MB created in the last two weeks on a file server hosting patient records, with no corresponding backup job, warrant immediate triage.

Remediation & Verification Script

Run this against your Microsoft 365 tenant to surface the exact persistence mechanism used in these breaches — hidden forwarding and deletion rules — and to verify legacy auth is disabled:

# Requires: ExchangeOnlineManagement module, connected with Connect-ExchangeOnline
# Audit all mailboxes for forwarding/deletion inbox rules — the BEC persistence pattern
$results = foreach ($mbx in (Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox,SharedMailbox)) {
    Get-InboxRule -Mailbox $mbx.UserPrincipalName -ErrorAction SilentlyContinue |
        Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo -or $_.DeleteMessage } |
        Select-Object @{n='Mailbox';e={$mbx.UserPrincipalName}}, Name, ForwardTo, RedirectTo, DeleteMessage
}
$results | Format-Table -AutoSize
$results | Export-Csv -Path ".\InboxRuleAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# Check for SMTP forwarding set at the mailbox level (bypasses inbox rules entirely)
Get-EXOMailbox -ResultSize Unlimited |
    Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
    Select-Object UserPrincipalName, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward

# Verify legacy authentication is disabled via authentication policy
Get-AuthenticationPolicy | Select-Object Name, AllowBasicAuthImap, AllowBasicAuthPop, AllowBasicAuthSmtp, AllowBasicAuthActiveSync

Any external forwarding destination you cannot attribute to a documented, approved business process is an incident until proven otherwise. Pull message trace for that mailbox, scope what PHI-containing messages were forwarded, and treat it as a reportable-breach determination question for counsel.

Remediation: Closing the Doors These Incidents Walk Through

Immediate (This Week)

1. Enforce phishing-resistant MFA tenant-wide — no exceptions for service accounts, executives, or "temporary" gaps. Microsoft reported years ago that MFA blocks over 99% of automated credential attacks; every healthcare breach postmortem we have worked that lacked MFA would likely have been stopped by it.
2. Disable legacy authentication (IMAP, POP, basic SMTP auth) via an authentication policy, and block external auto-forwarding at the tenant level with an outbound spam filter policy. Individual mailbox rules then cannot silently exfiltrate mail.
3. Audit inbox rules across all mailboxes using the script above. Do this quarterly at minimum; alert on new forwarding rules in near-real-time via the Sigma rule.
4. Verify EDR coverage on every server hosting PHI, including the file server nobody has patched because "it can't go down." That server is the target.

Near-Term (30–60 Days)

5. Segment the network. Patient-record systems, EHR databases, and file shares should sit behind access controls that a compromised receptionist workstation cannot traverse. Flat networks are why a single phished mailbox becomes a 12,500-patient breach.
6. Deploy attack surface monitoring for externally exposed RDP, VPN appliances, and remote management tools — the other dominant initial access path into small healthcare providers.
7. Test your backups with an actual restore, and isolate backup credentials from domain credentials. Shadow-copy deletion only matters to an attacker if it works.
8. Inventory your business associates. If a billing vendor or IT provider holds your PHI, their breach is your notification obligation. Review BAAs and ask hard questions about their MFA and monitoring posture.

Regulatory & Governance

• HIPAA breach notification: breaches affecting 500+ individuals require notification to HHS OCR, affected individuals, and prominent media within 60 days of discovery. Sub-500 breaches are reported to OCR annually. Build the forensic capability to make the count determination defensibly — OCR audits the methodology.
• HIPAA Security Rule modernization: the proposed Security Rule update (NPRM published in late 2024, progressing through the rulemaking process into 2025–2026) would make MFA, encryption, network segmentation, and asset inventories mandatory rather than addressable. Treat those proposed requirements as your implementation baseline now — they describe exactly the controls whose absence enables incidents like this one.
• 42 CFR Part 2: providers handling substance-use-disorder records (directly relevant to organizations like Resource Center) face heightened confidentiality requirements. Factor this into breach determination and notification workflows.
• Map controls to CIS Controls v8 (Controls 4, 5, 6, 8, 11 cover most of the above) and use the NIST CSF 2.0 Govern function to get board-level visibility into this risk before OCR does it for you.

The Bottom Line

The Resource Center of Dallas incident is not an anomaly — it is the median healthcare breach in 2026: a community provider, a compromised account or system, PHI exposure, months of forensic review, and a notification that lands hardest on a vulnerable patient population. The attack techniques involved are neither novel nor sophisticated, which is precisely the indictment. Every behavior in the chain — the phished credential, the forwarding rule, the staged archive, the deleted shadow copy — is detectable with the telemetry a small organization can afford, and preventable with controls that are no longer optional under the direction regulation is moving.

If your organization cannot run the hunt queries above today, that gap is your actual finding. Close it before you are writing the notification letter.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub