Back to Intelligence

Sutherland Healthcare Solutions and Hoag Memorial Hospital Breaches: Detecting and Containing Third-Party PHI Exfiltration

SA
Security Arsenal Team
November 10, 2026
11 min read

Two healthcare organizations — Sutherland Healthcare Solutions, a HIPAA business associate, and Hoag Memorial Hospital Presbyterian, a California hospital system — have confirmed cybersecurity incidents resulting in data breaches. For defenders, this pairing is significant: one victim is a third-party service provider that handles protected health information (PHI) on behalf of covered entities, and the other is a direct care provider. Together they illustrate the two dominant breach surfaces in healthcare today — your own network, and your vendors' networks.

Introduction: Why This Matters to Every Healthcare Defender

Business associates like Sutherland sit at the center of healthcare data flows — billing, revenue cycle management, claims processing, transcription, and analytics. They hold PHI for dozens or hundreds of covered entities simultaneously. A single compromise at a business associate can cascade into breach notification obligations across an entire client portfolio, which is exactly why regulators treat business associate incidents with heightened scrutiny under HIPAA's Breach Notification Rule (45 CFR §§ 164.400–414).

For hospital systems like Hoag, the incident is a reminder that attackers continue to prioritize healthcare for a simple reason: PHI has durable monetization value. Unlike payment card data, medical records cannot be reissued. They support insurance fraud, identity theft, and extortion leverage for years.

Whether the initial access vector in these incidents was phishing, credential abuse, an exploited internet-facing service, or a compromised downstream vendor, the post-compromise phase of nearly every healthcare breach we respond to follows a recognizable pattern: discovery of PHI repositories, staging of data into archives, and bulk exfiltration — often via cloud sync tooling or direct transfer to attacker-controlled infrastructure. That phase is where defenders have the best chance to interdict before data leaves the building, and that is where this post focuses.

Technical Analysis: The Healthcare Exfiltration Attack Chain

Because the public disclosures for these incidents are recent and forensic details remain limited, we will not speculate on specific intrusion vectors. What we can do — and what provides genuine defensive value — is break down the attack chain we consistently observe in healthcare breaches of this profile, mapped to MITRE ATT&CK, so your detections target behaviors rather than indicators that expire in a week.

Typical attack chain in healthcare PHI theft incidents:

  1. Initial Access (TA0001): Spearphishing against administrative/revenue-cycle staff (T1566.001), or exploitation of internet-facing remote access (T1133) — VPN concentrators, Citrix/remote access gateways, or exposed RDP remain the top vectors in our healthcare IR caseload.
  2. Discovery (TA0007): Attackers enumerate file shares, EHR-adjacent databases, and billing systems. Look for rapid share enumeration (net view, net share, ADFind, SharpHound-style BloodHound collection).
  3. Collection (TA0009): Bulk access to PHI file shares and document repositories (T1213, T1005). This is the highest-fidelity detection opportunity — legitimate users access dozens of files a day; attackers access tens of thousands.
  4. Staging & Compression (TA0009/TA0010 prep): Data is staged into temp directories and compressed with 7-Zip, WinRAR, or similar tooling (T1560.001), frequently with password-protected archives.
  5. Exfiltration (TA0010): Rclone, MEGAsync, or direct HTTPS upload to cloud storage and file-sharing services (T1567.002). Rclone in particular has become near-ubiquitous in the ransomware and data-theft ecosystem.
  6. Impact / Extortion (TA0040): In double-extortion scenarios, log deletion (T1070.001) and shadow copy deletion precede encryption or the mere threat of publication.

Exploitation status: No CVE has been publicly associated with either incident at time of writing. Treat this as a technique-driven threat: the TTPs above are actively and continuously used against healthcare targets in 2025–2026, and the detections below target them directly.

Detection & Response

The following detections target the staging, exfiltration, and anti-forensics behaviors common to healthcare data-theft intrusions. Each is written to be high-fidelity — tuned for behaviors that have almost no legitimate business justification in a clinical or back-office environment.

Sigma Rules

YAML
---
title: Cloud Sync Exfiltration Tool Execution (Rclone / MEGAsync / similar)
id: 3f7c9a21-8b44-4e5d-b6a2-9d1e5f7c8a90
status: experimental
description: Detects execution of cloud synchronization tools commonly abused for bulk PHI exfiltration from healthcare environments. Rclone and MEGAsync have no legitimate presence on most clinical and billing workstations.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://www.hipaajournal.com/sutherland-healthcare-hoag-memorial-hospital-data-breaches/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\MEGAsync.exe'
      - '\MEGAcmd.exe'
      - '\filezilla.exe'
      - '\winscp.exe'
  selection_cli:
    CommandLine|contains:
      - 'rclone copy'
      - 'rclone move'
      - 'rclone sync'
      - '--transfers'
  condition: selection_img or selection_cli
falsepositives:
  - IT-managed backup solutions using rclone (whitelist by approved path and service account)
level: high
---
title: Mass Archive Creation via Command-Line Compression Tools
id: 8a2d4e16-5c37-4f89-a1b3-6e9d2c4f7b81
status: experimental
description: Detects 7-Zip or WinRAR invoked from the command line to create archives, a hallmark of data staging before exfiltration. Password-protected archive flags significantly raise suspicion.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.hipaajournal.com/sutherland-healthcare-hoag-memorial-hospital-data-breaches/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_args:
    CommandLine|contains:
      - ' a '
      - ' u '
  selection_suspicious_flags:
    CommandLine|contains:
      - '-p'
      - '-hp'
      - '-v'
  condition: selection_img and selection_args and selection_suspicious_flags
falsepositives:
  - Legitimate administrative archiving (rare on clinical/billing endpoints; investigate any hits outside IT-managed systems)
level: high
---
title: Windows Event Log Clearing via wevtutil
id: 5b1e8d43-2a96-4c7d-93f4-1c8a6e3b9d52
status: experimental
description: Detects clearing of Windows event logs via wevtutil, an anti-forensic technique observed in healthcare intrusions prior to or following data theft and ransomware deployment.
references:
  - https://attack.mitre.org/techniques/T1070/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1070.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains:
      - 'cl '
      - 'clear-log'
falsepositives:
  - Rare; some log rotation scripts. Any hit on a production healthcare endpoint warrants triage.
level: high

KQL — Microsoft Sentinel / Defender Hunt

This query hunts for the convergence of staging and exfiltration behaviors: compression or sync tooling executing on devices, correlated with large outbound network transfers from the same device within a short window. A single hit on either behavior may be benign; the correlation is what makes this actionable.

KQL — Microsoft Sentinel / Defender
let lookback = 7d;
let suspiciousProcs = dynamic(["rclone.exe", "megasync.exe", "7z.exe", "7za.exe", "rar.exe", "winscp.exe", "filezilla.exe"]);
let stagingDevices =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ (suspiciousProcs)
    | summarize FirstSeen=min(TimeGenerated), Commands=make_set(ProcessCommandLine, 10) by DeviceName, DeviceId, InitiatingProcessAccountName;
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has_any ("mega.nz", "mega.co.nz", "dropbox.com", "transfer.sh", "file.io", "wetransfer.com", "gofile.io", "anonfiles")
   or (RemotePort in (443, 21, 22) and RemoteIPType == "Public")
| summarize OutboundConnections=count(), DistinctDestinations=dcount(RemoteIP), Destinations=make_set(RemoteUrl, 10) by DeviceName, DeviceId, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where OutboundConnections > 50 or DistinctDestinations > 5
| join kind=inner stagingDevices on DeviceId
| project DeviceName, InitiatingProcessAccountName, FirstSeen, Commands, OutboundConnections, Destinations, TimeGenerated
| order by TimeGenerated desc;

Tune the destination list against your organization's sanctioned file-transfer services. If your revenue-cycle or HIM teams legitimately use a specific SFTP endpoint for payer file exchange, whitelist that destination — but scrutinize everything else.

Velociraptor VQL — Endpoint Hunt

This artifact hunts for freshly created large archive files in staging-prone directories alongside execution of compression tooling, giving IR teams a fast sweep across a fleet when investigating suspected data theft.

VQL — Velociraptor
-- Hunt for staged archives and compression tool artifacts on endpoints
SELECT FullPath, Size, Mtime, Btime,
       basename(path=FullPath) AS FileName
FROM glob(globs=[
  'C:/Windows/Temp/**/*.zip',
  'C:/Windows/Temp/**/*.rar',
  'C:/Windows/Temp/**/*.7z',
  'C:/Users/*/AppData/Local/Temp/**/*.7z',
  'C:/Users/*/AppData/Local/Temp/**/*.rar',
  'C:/ProgramData/**/*.7z',
  'C:/ProgramData/**/*.rar'
])
WHERE Size > 10485760
  AND Mtime > now() - 604800
ORDER BY Mtime DESC

Pair this with a process sweep for rclone and compression binaries to identify the staging account and pivot into full timeline analysis:

VQL — Velociraptor
-- Identify running compression / exfiltration tooling and their parent processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)rclone|megasync|7z|winrar|rar\.exe|winscp|filezilla'
   OR CommandLine =~ '(?i)rclone (copy|move|sync)|-hp|-p[a-z0-9]'

Remediation / Hardening Script

The following PowerShell performs verification and hardening actions relevant to this threat class: enabling detailed file-share access auditing on PHI repositories (the single most valuable telemetry source for detecting mass collection), checking for unauthorized compression/sync binaries, and confirming audit policies are active.

PowerShell
#Requires -RunAsAdministrator
# Healthcare PHI Exfiltration Hardening & Verification Script
# Run on file servers hosting PHI shares and on management jump hosts

$report = @{ Timestamp = Get-Date; Findings = @() }

# 1. Verify Object Access auditing is enabled (required for mass-read detection on PHI shares)
$auditPol = auditpol /get /subcategory:"File Share","Detailed File Share","File System" 2>$null
if ($auditPol -notmatch 'Success') {
    Write-Host "[!] File System / File Share auditing NOT capturing Success events. Enabling..." -ForegroundColor Red
    auditpol /set /subcategory:"File Share" /success:enable /failure:enable
    auditpol /set /subcategory:"Detailed File Share" /success:enable
    auditpol /set /subcategory:"File System" /success:enable /failure:enable
    $report.Findings += "Enabled Success auditing for File Share, Detailed File Share, File System"
} else {
    Write-Host "[+] Object access auditing already enabled." -ForegroundColor Green
}

# 2. Scan for unauthorized exfiltration/staging binaries across common locations
$suspectBinaries = @('rclone.exe','megasync.exe','megacmd.exe','winscp.exe','filezilla.exe','7z.exe','7za.exe','rar.exe')
$searchPaths = @('C:\Users','C:\ProgramData','C:\Windows\Temp')
foreach ($path in $searchPaths) {
    Get-ChildItem -Path $path -Recurse -Include $suspectBinaries -ErrorAction SilentlyContinue |
        ForEach-Object {
            Write-Host "[!] Suspicious binary found: $($_.FullName)" -ForegroundColor Red
            $report.Findings += "FOUND: $($_.FullName)"
        }
}

# 3. Check PHI share SACLs — without SACLs, audit policy alone generates nothing
$phiShares = Get-SmbShare | Where-Object { $_.Name -notmatch '^(ADMIN\$|C\$|IPC\$|print\$|NETLOGON|SYSVOL)$' }
foreach ($share in $phiShares) {
    $acl = Get-Acl $share.Path -Audit -ErrorAction SilentlyContinue
    if (-not $acl -or -not $acl.Audit) {
        Write-Host "[!] Share '$($share.Name)' ($($share.Path)) has NO audit SACL — mass file access will be invisible." -ForegroundColor Yellow
        $report.Findings += "MISSING SACL: $($share.Path)"
    }
}

# 4. Verify log forwarding / retention posture
$secLog = Get-WinEvent -ListLog Security
Write-Host "[i] Security log max size: $([math]::Round($secLog.MaximumSizeInBytes/1MB)) MB"
if ($secLog.MaximumSizeInBytes -lt 1GB) {
    wevtutil sl Security /ms:4294967296
    $report.Findings += "Expanded Security log to 4GB"
}

$report | ConvertTo-Json -Depth 3 | Out-File "$env:TEMP\phi_exfil_hardening_$(Get-Date -Format yyyyMMdd_HHmm).json"
Write-Host "Report written to $env:TEMP. Review all FINDINGS entries before closing." -ForegroundColor Cyan

Remediation and Defensive Actions

Because no vendor patch or CVE applies here, remediation is architectural and procedural:

  1. If you are a Sutherland Healthcare Solutions client (or a client of any affected business associate): Treat this as an active third-party incident. Invoke your BAA incident provisions, demand a specific data-element accounting of what was accessed, and begin scoping your own breach notification obligations now — the HIPAA 60-day clock and state AG notification timelines run from your discovery, not the vendor's announcement date.

  2. Deploy mass-access detection on PHI repositories. Enable Detailed File Share auditing (Event ID 5145) and alert on single accounts reading an anomalous volume of distinct files within a short window. This is the highest-value control against the collection phase described above.

  3. Block unauthorized exfiltration tooling. Use AppLocker or WDAC to prohibit rclone, MEGAsync, and unapproved FTP/SFTP clients on all endpoints and servers. Egress-filter outbound traffic at the perimeter — deny direct internet access from servers hosting PHI except through an inspected proxy.

  4. Inventory and constrain business associate access. Every vendor with VPN, API, or SFTP access into your environment should be authenticated through your IdP with MFA, logged, and scoped to least-privilege network segments. Review service accounts for stale credentials and excessive share permissions — service account abuse is a recurring finding in our healthcare IR engagements.

  5. Test your notification runbook. Legal counsel, cyber insurance carrier, HHS OCR portal procedures, state AG notification templates, and patient communication workflows should be tabletop-exercised, not written during an active incident.

  6. Hunt retroactively. Run the KQL and VQL content above across the last 90 days. Breach disclosures typically lag compromise by weeks to months — assume the dwell time window extends before the announcement date.

Conclusion

The Sutherland Healthcare Solutions and Hoag Memorial Hospital incidents reinforce what 2025 and 2026 breach data keeps telling us: healthcare's softest underbelly is the intersection of third-party access and unmonitored PHI repositories. Attackers do not need zero-days when a stolen credential, an unaudited file share, and an unblocked copy of rclone will do the job. The detections and hardening steps above target exactly that reality. Deploy them before your organization is writing its own notification letters.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub

healthcare-cybersecurityhipaa-compliancehealthcare-ransomwareehr-securitymedical-data-breachsutherland-healthcare-solutionshoag-memorial-hospitalhealthcare-data-breachphi-exfiltrationbusiness-associate-risk

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action