Secure Healthcare Information Management, a Pennsylvania-based medical management and billing service provider, and Desert Orthopaedic Center have both disclosed data breaches, as reported by The HIPAA Journal. Incidents like these follow a pattern I've investigated dozens of times over 15 years in IR: an attacker gains a foothold — often through compromised credentials, a phishing-delivered payload, or an exposed remote service — dwells quietly inside a network rich with protected health information (PHI), stages and exfiltrates data, and the organization discovers the intrusion weeks or months later, often only after the attacker announces it or anomalous activity finally trips an alert.
Billing service providers are particularly high-value targets. They sit at a trust nexus: they hold demographic, insurance, and clinical data for multiple downstream covered entities, and they frequently have broad network trust relationships with those clients' systems. A single compromise at a billing vendor becomes a multi-organization breach — which is exactly why business associates are regulated directly under HIPAA and why your vendor risk program matters as much as your own perimeter.
This post breaks down the defensive anatomy of these breaches: how attackers typically operate inside healthcare environments, what you should be hunting for right now, and how to close the gaps before your organization becomes the next notification letter.
Why Healthcare Billing and Specialty Practices Keep Getting Hit
Three structural realities make these targets attractive:
1. Data density. Billing systems aggregate patient names, dates of birth, Social Security numbers, insurance IDs, diagnosis and procedure codes — everything needed for identity theft, insurance fraud, and highly credible spear-phishing. Orthopaedic and specialty practices add clinical imagery and operative notes.
2. Flat, legacy-heavy networks. Smaller providers and billing shops often run flat networks where the billing application server, domain controller, and workstations share trust. Once inside, lateral movement is trivial.
3. Detection gaps. Many mid-size healthcare organizations have no EDR coverage on servers, no egress monitoring, and no one watching authentication logs after 5 PM. Average dwell time in healthcare intrusions I've worked has consistently exceeded 90 days.
Attack Anatomy: What We Typically See in These Intrusions
While the full forensic details of these two incidents are still emerging, the tradecraft in healthcare billing-sector breaches is remarkably consistent. Defenders should assume the following attack chain and hunt against it:
Initial access: Phishing with credential harvesting against Microsoft 365, or exploitation of exposed remote services (RDP, VPN appliances, unpatched firewalls). Business email compromise (BEC) against billing staff is also common — the mailbox of a billing coordinator is a goldmine of EOBs, patient statements, and insurance correspondence.
Persistence and discovery: Web shells on internet-facing servers, creation of local admin accounts, or abuse of legitimate remote access tools (AnyDesk, ScreenConnect, Splashtop) that blend into healthcare IT environments.
Collection and staging: Attackers run database exports against billing/practice management systems, or bulk-copy file shares containing scanned documents. Staging almost always involves compression — rar.exe, 7z.exe, or PowerShell Compress-Archive — into directories like C:\ProgramData, C:\Windows\Temp, or user profile folders.
Exfiltration: Large outbound transfers to cloud storage (MEGA, Dropbox, Google Drive) or attacker-controlled infrastructure over HTTPS/443, frequently via rclone.exe renamed to something innocuous.
Every one of those behaviors is detectable. The problem is rarely tooling — it's that nobody deployed the detections.
Detection & Response
SIGMA Detections
The following rules target the staging and exfiltration behaviors that appear in virtually every healthcare data-theft intrusion. They are tuned to minimize noise: compression binaries executed from unusual paths, and renamed rclone.
---
title: Data Staging via Compression Utility in Suspicious Path
id: 8f2c4a71-3b9d-4e6f-a1c2-5d7e9f0b2a44
status: experimental
description: Detects execution of compression/archiving utilities from directories commonly used by attackers to stage stolen PHI prior to exfiltration. Observed repeatedly in healthcare data-theft intrusions.
references:
- https://attack.mitre.org/techniques/T1560/001/
- https://www.hipaajournal.com/secure-healthcare-information-management-desert-orthopaedic-center-data-breaches/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection_binary:
Image|endswith:
- '\rar.exe'
- '\7z.exe'
- '\7za.exe'
- '\winrar.exe'
selection_path:
Image|contains:
- '\ProgramData\'
- '\Windows\Temp\'
- '\Users\Public\'
- '\AppData\Local\Temp\'
condition: selection_binary and selection_path
falsepositives:
- Software deployment tools staging packages in ProgramData
- IT backup scripts using 7-Zip
level: high
---
title: Rclone Execution or Renamed Rclone Binary
id: 2b7d9e35-1c4a-4f82-b6e3-8a0d5c9f7e21
status: experimental
description: Detects rclone execution by command-line flags or original filename in PE metadata, catching renamed copies used for bulk exfiltration of healthcare data to cloud storage.
references:
- https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection_cli:
CommandLine|contains:
- 'rclone copy'
- 'rclone move'
- 'rclone sync'
- '--config'
selection_meta:
OriginalFileName: 'rclone.exe'
condition: 1 of selection_*
falsepositives:
- Legitimate rclone backup jobs (whitelist known service accounts and paths)
level: high
---
title: Web Server Process Spawning Command Shell
id: 4e9a1c58-7d3b-4f26-9c84-6b2e8d0a5f93
status: experimental
description: Detects IIS, Apache, or Tomcat worker processes spawning command shells or PowerShell — a hallmark of web shell activity on internet-facing healthcare portals and billing applications.
references:
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.persistence
- attack.t1505.003
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\w3wp.exe'
- '\httpd.exe'
- '\tomcat9.exe'
- '\tomcat8.exe'
- '\nginx.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\net.exe'
- '\whoami.exe'
condition: selection_parent and selection_child
falsepositives:
- Rare; some legacy billing apps shell out for report generation — investigate before tuning
level: critical
KQL Hunt — Microsoft Sentinel / Defender
This query hunts for the collection-and-staging phase: processes touching large numbers of files in directories typical of scanned medical records, combined with compression or archive creation, plus outbound transfers to consumer cloud storage. Run it across your billing servers, file servers, and any endpoint with access to PHI shares.
// Hunt: PHI staging and exfiltration behaviors on healthcare endpoints/servers
// Covers: mass file access, archive creation, cloud-storage exfiltration
let lookback = 14d;
let cloudExfilDomains = dynamic(["mega.nz", "mega.co.nz", "dropbox.com", "drive.google.com", "wetransfer.com", "sendspace.com", "file.io", "transfer.sh", "anonfiles.com", "gofile.io"]);
let stagingPaths = dynamic([@"\ProgramData\", @"\Windows\Temp\", @"\Users\Public\"]);
// Signal 1: Compression tooling executed from staging directories
let staging = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winrar.exe")
or ProcessCommandLine has_any ("Compress-Archive", "rclone")
| where FolderPath has_any (stagingPaths) or ProcessCommandLine has_any (stagingPaths)
| project StagingTime=Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath;
// Signal 2: Large outbound transfers to consumer cloud storage
let exfil = DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where RemoteUrl has_any (cloudExfilDomains)
| project ExfilTime=Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP;
// Correlate devices appearing in both signals
staging
| join kind=inner exfil on DeviceName
| project DeviceName, AccountName, StagingTime, FileName, ProcessCommandLine, ExfilTime, InitiatingProcessFileName, RemoteUrl, RemoteIP
| order by DeviceName asc, StagingTime asc;
A second query worth running if you ingest Microsoft 365 audit logs — BEC against billing staff is a primary vector in this sector, and malicious inbox rules are the earliest reliable indicator:
// Hunt: Suspicious inbox rules in M365 (billing/AR mailboxes are prime BEC targets)
CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules")
| extend RuleParams = tostring(RawEventData.Parameters)
| where RuleParams has_any ("DeleteMessage", "MoveToFolder", "ForwardTo", "RedirectTo")
and (RuleParams has_any ("RSS", "Deleted Items", "Archive") or RuleParams has "@")
| project Timestamp, AccountDisplayName, AccountObjectId, IPAddress, ActionType, RuleParams
| order by Timestamp desc;
Velociraptor VQL Hunt
Use this artifact across servers hosting billing applications, practice-management databases, and file shares. It surfaces recently created archives in staging locations alongside unexpected processes with outbound connections — the two artifacts attackers almost cannot avoid leaving behind.
-- Hunt: Staged archives in suspicious paths + processes with established external connections
-- Deploy against billing servers, file servers, and domain-joined endpoints holding PHI
LET archives = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
'C:/ProgramData/**/*.zip',
'C:/ProgramData/**/*.rar',
'C:/ProgramData/**/*.7z',
'C:/Windows/Temp/**/*.zip',
'C:/Windows/Temp/**/*.rar',
'C:/Users/Public/**/*.rar',
'C:/Users/Public/**/*.7z'
])
WHERE Mtime > now() - 1209600 -- modified in last 14 days
AND Size > 10000000 -- larger than 10 MB
LET extconn = SELECT Pid, Name, Path, Raddr, Rport, Status
FROM netstat()
WHERE Status = 'ESTABLISHED'
AND Rport in (443, 22, 21)
AND NOT Raddr =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'
AND NOT Path =~ '(?i)(windows|microsoft|office|defender)'
SELECT * FROM archives
UNION ALL
SELECT FullPath=Path, Size=Pid, Mtime=Raddr, Btime=Rport FROM extconn
Note the union is a compact triage view; in production, run the two SELECTs as separate artifacts (Windows.Hunt.StagedArchives and Windows.Hunt.ExternalConnections) so you can scope and filter independently.
Hardening & Verification Script
Run this on Windows servers hosting billing or practice-management applications to verify audit policy coverage, identify non-standard remote access tools, and check for web shell indicators in IIS content directories.
# Security Arsenal - Healthcare Breach Readiness Check
# Run as Administrator on billing/app servers and file servers
Write-Host "=== 1. Audit Policy: Process Creation + Command Line Logging ===" -ForegroundColor Cyan
auditpol /get /subcategory:"Process Creation"
$cmdline = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -ErrorAction SilentlyContinue
if ($cmdline.ProcessCreationIncludeCmdLine_Enabled -ne 1) {
Write-Host "[!] Command-line auditing NOT enabled. Enabling now..." -ForegroundColor Yellow
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1
Write-Host "[+] Enabled. Verify Event ID 4688 includes command lines." -ForegroundColor Green
} else {
Write-Host "[+] Command-line auditing is enabled." -ForegroundColor Green
}
Write-Host "`n=== 2. Unauthorized Remote Access Tools ===" -ForegroundColor Cyan
$ratTools = 'anydesk|screenconnect|splashtop|teamviewer|logmein|ammyy|rustdesk|ultraviewer'
$installed = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -match $ratTools } | Select-Object DisplayName, InstallDate, Publisher
if ($installed) {
Write-Host "[!] Remote access tools found - verify each is IT-approved:" -ForegroundColor Yellow
$installed | Format-Table -AutoSize
} else {
Write-Host "[+] No common RMM/remote access tools detected." -ForegroundColor Green
}
Write-Host "`n=== 3. IIS Web Shell Indicators (scripts in web root, recent) ===" -ForegroundColor Cyan
$webroots = @('C:\inetpub\wwwroot')
foreach ($root in $webroots) {
if (Test-Path $root) {
Get-ChildItem -Path $root -Recurse -Include *.aspx,*.asp,*.ashx,*.php,*.jsp -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-60) } |
Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize
}
}
Write-Host "`n=== 4. Egress: Recent large outbound connections from this host ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|169\.254\.|0\.0\.0\.0|::)' } |
Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess,
@{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
Sort-Object RemoteAddress -Unique | Format-Table -AutoSize
Write-Host "`n=== 5. SMB Share Exposure (PHI shares should be locked down) ===" -ForegroundColor Cyan
Get-SmbShare | Where-Object { $_.Name -notmatch '^(ADMIN|IPC|C)\$$' } | ForEach-Object {
$acl = Get-SmbShareAccess -Name $_.Name
$_.Name + ' -> ' + ($acl | ForEach-Object { "$($_.AccountName):$($_.AccessRight)" }) -join ', '
}
Write-Host "`nReview: any share with 'Everyone' or broad 'Full' access holding PHI is a finding." -ForegroundColor Yellow
Remediation and Prevention: What Actually Moves the Needle
For organizations in the blast radius of these breaches — and every healthcare entity that wants to avoid joining them — prioritized actions:
If you are a client of Secure Healthcare Information Management or Desert Orthopaedic Center:
- Invoke your Business Associate Agreement (BAA) incident provisions now. Demand the forensic report scope: what data elements, what time window, what systems, and whether exfiltration is confirmed or only access.
- Determine your notification obligations. Under HIPAA, covered entities — not just the breached business associate — carry breach notification duties (individuals, HHS OCR, and media for breaches affecting 500+ individuals). State attorneys general notification timelines (often 30–60 days) may be tighter.
- Prepare credit monitoring and call-center capacity before letters go out, not after.
For all healthcare organizations (the real lesson):
- MFA everywhere, no exceptions for legacy apps. Every healthcare breach postmortem I have led in the last three years involved either a phished credential without MFA or an exposed remote service. Put MFA on M365, VPN, RDP gateways, and any portal reachable from the internet. Use conditional access to block legacy authentication protocols outright.
- Segment the billing/EHR environment. The billing server should not be able to reach the domain controller on arbitrary ports, and workstations should not reach database servers directly. VLAN segmentation plus host-based firewall rules would have contained the lateral movement in most incidents I've worked.
- Deploy egress filtering and alert on it. Block outbound 443 to unsanctioned cloud storage from servers. There is no legitimate reason for your practice-management database server to talk to MEGA or Dropbox. This single control defeats the exfiltration stage of the kill chain.
- Watch the mailboxes. Deploy the inbox-rule KQL above, alert on external forwarding, and review sign-in logs for impossible travel and token-theft indicators. BEC against billing staff is a breach even when no malware touches your network.
- Tabletop the notification clock. HIPAA's 60-day notification deadline and state AG requirements run from discovery, not from when your forensics firm finishes. Practice the decision tree: who declares a breach, who calls counsel, who drafts the OCR filing.
- Enforce BAA minimums contractually. Require business associates to carry EDR on PHI-touching systems, maintain immutable backups, and notify you within a defined window (24–72 hours) of suspected incidents — then audit attestations annually.
The Bottom Line
The Secure Healthcare Information Management and Desert Orthopaedic Center disclosures are not anomalies — they are the continuing tax the industry pays for flat networks, unmonitored egress, and vendor trust without verification. The good news for defenders: the attacker behaviors in these breaches are loud if you're listening. Compression utilities in ProgramData, renamed rclone, web shells spawning shells, malicious inbox rules — none of this requires exotic telemetry. It requires deploying the detections you already have licenses for and assigning a human to look at the output.
If your organization cannot answer "would we catch bulk archive creation on our billing server tonight?" with confidence, that is your gap to close this quarter.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.