Sunshine Health, a Florida-based Medicaid managed care plan, and Health Payment Systems (HPS), a Wisconsin-based third-party administrator serving employer-sponsored health plans, have both reported data breaches involving protected health information (PHI). These incidents — disclosed through the standard HIPAA breach notification process — follow a pattern I've seen repeatedly across 15 years of incident response in the healthcare vertical: the compromised entity is often not the covered entity itself, but a business associate, claims processor, or vendor sitting one or two hops away in the data supply chain.
For defenders, the lesson is not abstract. If your organization exchanges eligibility files, claims data, or member rosters with downstream vendors, your PHI exposure surface is only as strong as the weakest business associate in your chain. This post breaks down the defensive implications of these breaches, provides detection content for hunting bulk PHI access and exfiltration, and lays out a remediation roadmap for healthcare security teams.
What Happened
Sunshine Health and Health Payment Systems each reported data breach incidents involving unauthorized access to systems containing member and patient data. As is typical in these disclosures, the exposed data categories in incidents of this type include the full identity-theft toolkit: names, dates of birth, Social Security numbers, health insurance member IDs, claims information, and in some cases clinical or treatment data. HPS operates as a third-party administrator, meaning the data it holds belongs to the health plans and employers it services — a single compromise at a TPA cascades across dozens of downstream covered entities.
No CVE has been publicly associated with either incident, and exploitation details remain limited in the disclosures. What we can say with confidence, based on the attack patterns dominating healthcare breaches in 2025 and into 2026, is that the dominant initial access vectors against payers and TPAs remain:
- Credential-based attacks against remote access infrastructure (VPN, Citrix, RDP) without enforced phishing-resistant MFA
- Compromise of file transfer and data exchange platforms used to move claims and eligibility files between entities
- Business email compromise (BEC) leading to fraudulent access to member portals or mailbox-hosted PHI
- Third-party/vendor compromise, where an attacker pivots from a less-defended business associate into the covered entity's data
The exploitation status here is confirmed unauthorized access with reportable PHI exposure under HIPAA — this is not theoretical. Both organizations are in the notification and remediation phase.
Why Healthcare Defenders Need to Act Now
Three reasons these breaches matter beyond the directly affected organizations:
- Your data may be in there. If your health plan, employer group, or provider network does business with HPS or shares members with Sunshine Health's Florida Medicaid book of business, you have a notification and risk-assessment obligation even if your own systems were never touched.
- Breach-notification data fuels follow-on attacks. Stolen member data from payer breaches is weaponized within weeks for highly credible medical identity theft, insurance fraud, and spear phishing against members. Expect your patients and members to be targeted.
- Regulatory exposure is compounding. OCR has been increasingly aggressive in enforcement actions where risk analyses failed to account for business associate access pathways. A breach at your vendor that you never monitored or audited is no longer a defensible position.
Technical Analysis: The Attack Pattern Behind Payer and TPA Breaches
While specific forensic details of these two incidents have not been fully published, the operational pattern in payer/TPA breaches I've responded to over the past two years is remarkably consistent. Defenders should hunt for the following chain:
Stage 1 — Initial access via identity. Attackers authenticate with valid credentials (phished, purchased, or brute-forced) against internet-facing remote access or web portals. Log source: VPN/SSO authentication logs showing impossible travel, anomalous ASN, or legacy protocol auth.
Stage 2 — Reconnaissance of data stores. Once inside, the actor enumerates file shares, claims databases, and reporting servers. Watch for service accounts or user accounts suddenly querying claims tables at volumes or hours inconsistent with their baseline.
Stage 3 — Staging and archive creation. PHI is aggregated and compressed — typically with 7-Zip, WinRAR, or built-in compress-archive tooling — into staging directories before egress.
Stage 4 — Exfiltration. Bulk transfer over HTTPS to cloud storage (Mega, Dropbox, file[.]io, attacker-hosted endpoints) or via SFTP. Volume is the tell: payer breaches routinely involve gigabytes to terabytes of egress.
Stage 5 (sometimes) — Encryption and extortion. Double-extortion actors encrypt after exfiltration; pure data-theft groups skip this and go straight to leak-site pressure.
The detections below target stages 3 and 4 — the chokepoints where you can still interrupt the breach before notification obligations become breach headlines.
Detection & Response
The following content targets the observable behaviors most consistent with payer/TPA breach tradecraft: bulk archive creation in data staging locations, anomalous database access volume, and large outbound data transfers. Tune thresholds to your environment before deployment.
---
title: Mass Archive Creation in PHI Staging or Claims Data Directories
id: 3f8c1a92-5d4e-4b7a-9c21-8e6f2a4b9d01
status: experimental
description: Detects creation of compressed archives by common archiving tools in directories associated with claims data, member rosters, or file-transfer staging — a consistent pre-exfiltration behavior in healthcare payer and TPA breaches.
references:
- https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/02/14
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection_tool:
Image|endswith:
- '\7z.exe'
- '\7za.exe'
- '\rar.exe'
- '\winrar.exe'
selection_args:
CommandLine|contains:
- ' a '
- ' -r'
selection_path:
CommandLine|contains:
- 'claims'
- 'eligibility'
- 'members'
- 'staging'
- 'export'
- 'phi'
- '834'
- '837'
condition: selection_tool and selection_args and selection_path
falsepositives:
- Scheduled ETL jobs compressing claims files for routine SFTP delivery to business associates
- Backup agents using 7-Zip libraries
level: high
---
title: Anomalous Bulk Outbound Transfer from Database or File Servers
id: 8b2e4d71-6a3f-4c19-bd52-1f7a9c3e5d84
status: experimental
description: Detects large outbound network connections originating from database servers or file servers hosting claims/member data to external destinations — indicative of PHI exfiltration staging in payer breach incidents.
references:
- https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/02/14
tags:
- attack.exfiltration
- attack.t1041
logsource:
category: network_connection
product: windows
detection:
selection_server:
Image|endswith:
- '\sqlservr.exe'
- '\oracle.exe'
- '\mysqld.exe'
- '\postgres.exe'
selection_external:
Initiated: 'true'
filter_private:
DestinationIp|startswith:
- '10.'
- '172.16.'
- '192.168.'
condition: selection_server and selection_external and not filter_private
falsepositives:
- Database replication to disaster recovery sites (allowlist known DR ranges)
- Vendor support connections initiated by DBAs
level: high
// Hunt for anomalous outbound data volume from servers hosting claims/member data
// Tune the byte threshold and server list to your environment's baseline
let ServerBaseline = DeviceNetworkEvents
| where TimeGenerated > ago(30d) and TimeGenerated <= ago(1d)
| where DeviceName has_any ("claims", "sql", "db", "ftp", "edi")
| summarize AvgDailyBytes = avg(BytesSent) by DeviceName, bin(TimeGenerated, 1d)
| summarize BaselineAvg = avg(AvgDailyBytes), BaselineStdev = stdev(AvgDailyBytes) by DeviceName;
DeviceNetworkEvents
| where TimeGenerated > ago(1d)
| where DeviceName has_any ("claims", "sql", "db", "ftp", "edi")
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| summarize TotalBytesSent = sum(BytesSent), DistinctDestinations = dcount(RemoteIP), Destinations = make_set(RemoteIP, 20) by DeviceName, RemoteUrl, bin(TimeGenerated, 1h)
| join kind=inner ServerBaseline on DeviceName
| where TotalBytesSent > (BaselineAvg + (3 * BaselineStdev)) and TotalBytesSent > 500000000
| project TimeGenerated, DeviceName, RemoteUrl, TotalBytesSent, DistinctDestinations, BaselineAvg
| sort by TotalBytesSent desc
-- Hunt for recently created archives in data staging and export directories
-- across payer/TPA infrastructure — classic pre-exfiltration artifact
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
'D:/Claims/**/*.zip',
'D:/Claims/**/*.7z',
'D:/Claims/**/*.rar',
'D:/Exports/**/*.zip',
'D:/Exports/**/*.7z',
'E:/Staging/**/*.zip',
'C:/Users/*/AppData/Local/Temp/**/*.7z'
])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC
# Audit script: identify external data egress paths and stale business-associate
# access on servers hosting PHI. Run on claims/DB/file-transfer servers.
# 1. Enumerate enabled accounts with interactive logon in the last 30 days
# (stale vendor/service accounts are the top initial-access vector in TPA breaches)
$Cutoff = (Get-Date).AddDays(-30)
Get-ADUser -Filter {Enabled -eq $true} -Properties LastLogonDate, Description |
Where-Object { $_.LastLogonDate -gt $Cutoff -and ($_.Description -match 'vendor|partner|BA|external') } |
Select-Object SamAccountName, LastLogonDate, Description |
Export-Csv -Path "C:\Audit\ExternalAccounts.csv" -NoTypeInformation
# 2. Verify MFA-enforced remote access: list VPN/RDP listening services
Get-NetTCPConnection -State Listen |
Where-Object { $_.LocalPort -in 3389, 4433, 8443, 10443 } |
Select-Object LocalAddress, LocalPort, OwningProcess |
ForEach-Object {
$_ | Add-Member -NotePropertyName ProcessName -NotePropertyValue (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName -PassThru
} | Format-Table -AutoSize
# 3. Audit large archive files created in the last 14 days on data volumes
Get-ChildItem -Path 'D:\','E:\' -Recurse -Include *.zip,*.7z,*.rar -ErrorAction SilentlyContinue |
Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-14) -and $_.Length -gt 100MB } |
Select-Object FullName, Length, CreationTime, LastWriteTime |
Export-Csv -Path "C:\Audit\RecentLargeArchives.csv" -NoTypeInformation
# 4. Check outbound firewall policy: servers hosting PHI should have explicit egress deny-by-default
Get-NetFirewallRule -Direction Outbound -Action Allow -Enabled True |
Where-Object { $_.Profile -match 'Domain' } |
Measure-Object | Select-Object @{n='OutboundAllowRules';e={$_.Count}}
Write-Host "Audit complete. Review C:\Audit for external accounts and archive artifacts." -ForegroundColor Cyan
Remediation and Hardening Roadmap
If your organization is affected — directly or through a business associate relationship with either entity — execute the following:
Immediate (0–72 hours):
- Confirm your data relationship. Inventory whether your plan, employer groups, or provider network transact with HPS or share members with Sunshine Health. If yes, invoke the incident notification clause in your BAA and demand a formal incident report, affected-individual count, and forensic timeline.
- Reset credentials for any account that has authenticated to the affected vendor's portals or file-transfer platforms in the trailing 12 months. Assume credential replay.
- Review egress logs from your claims, EDI, and file-transfer servers for the past 90 days against the hunt query above.
Short term (1–4 weeks):
- Enforce phishing-resistant MFA (FIDO2/passkeys) on all remote access, member portals, and vendor-facing file-transfer platforms. Legacy MFA (SMS, push-only) remains the soft underbelly in payer breaches.
- Deploy egress filtering with deny-by-default outbound policy on database and EDI servers. PHI servers should talk to an explicit allowlist of business associate endpoints — nothing else.
- Implement database activity monitoring (DAM) on claims and member databases with alerting on query volume exceeding 3 standard deviations from per-account baselines.
- Conduct a HIPAA Security Rule risk analysis specifically scoped to business associate access pathways — OCR is explicitly citing missing vendor-pathway analysis in recent enforcement actions.
Strategic (30–90 days):
- Re-tier your vendor risk program. TPAs, claims processors, and eligibility vendors hold concentrated PHI and are systematically under-defended relative to covered entities. Require evidence of MFA enforcement, EDR coverage, and recent penetration tests as BAA conditions.
- Establish member-facing fraud monitoring. Breached member data will be used for insurance fraud and medical identity theft — coordinate with your SIU (special investigations unit) on anomalous claims patterns tied to exposed member cohorts.
- Tabletop the exact scenario: "our TPA calls us at 4 PM Friday to report a breach of our members' data." If your IR plan doesn't have that runbook, build it now.
Under HIPAA, covered entities retain notification obligations even when the breach occurs at a business associate. Both of these incidents should be treated as a live fire drill for your own third-party breach response procedures — because the next disclosure may carry your members' names.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.