Texas Hearing Institute Encryption Attack Exposes 30,000 Patient Records: Healthcare Ransomware Defense and Detection Guide

Texas Hearing Institute has disclosed a cybersecurity incident involving unauthorized access and encryption of systems containing protected health information (PHI) belonging to nearly 30,000 patients. The incident, reported by The HIPAA Journal, follows a pattern I've watched accelerate across my 15 years in IR: small and mid-sized specialty healthcare providers are being systematically targeted because they hold high-value PHI, operate lean IT/security teams, and face existential pressure to restore clinical operations quickly.

An "encryption-based cyber incident" disclosure under HIPAA almost always means one of two things: ransomware detonated on the network, or attackers staged data for extortion and encrypted systems to cover their tracks or increase leverage. Either way, the disclosure obligations under HIPAA's Breach Notification Rule (45 CFR §§ 164.400-414) are now in motion, and for the 30,000 affected patients, the risk window for medical identity theft and insurance fraud has opened — those harms persist for years, unlike credit card fraud which resolves with a card reissue.

If you defend a healthcare environment of any size, treat this as your tabletop scenario this week. The attack chain that hit Texas Hearing Institute is the same one I see in nearly every healthcare ransomware engagement I lead.

Technical Analysis: How These Healthcare Encryption Attacks Actually Work

While Texas Hearing Institute's disclosure does not attribute the attack to a specific group or CVE (no CVE identifier has been published in connection with this incident, and defenders should not invent one), the operational pattern of encryption-based incidents against specialty clinics is well-documented across hundreds of similar HIPAA breach reports. The typical chain:

1. Initial Access. For organizations of this profile, the dominant vectors remain:

• Phishing with credential harvesting against Microsoft 365 tenants lacking enforced phishing-resistant MFA
• Exposed remote access services (RDP, VPN concentrators, remote monitoring and management tools) with weak or reused credentials
• Compromised credentials purchased from initial access brokers — healthcare credentials are consistently among the cheapest on criminal markets

2. Persistence and Discovery. Attackers enumerate the environment with living-off-the-land tooling: net, nltest, AdFind, BloodHound for AD mapping, and PowerShell-based discovery. In small clinics without centralized EDR coverage, this phase is almost never detected.

3. Staging and Exfiltration. Before encryption, modern operators exfiltrate data — patient records, billing data, insurance information — to enable double extortion. Tools of choice: Rclone, WinSCP, or 7-Zip archives pushed over cloud storage endpoints.

4. Impact. Mass encryption via a ransomware payload, typically preceded by defense evasion: deletion of Volume Shadow Copies (vssadmin delete shadows /all /quiet), disabling of backup agents and services, and tampering with endpoint security. This is the step that turns a quiet intrusion into an operational crisis.

Exploitation status: There is no PoC or CVE to track here — this is a human-operated intrusion pattern, confirmed active against healthcare targets continuously through 2025 and into 2026. The healthcare sector remains one of the most-breached verticals by record count in HHS OCR breach reporting, and encryption/extortion incidents dominate the large-breach listings.

Why Specialty Clinics Are the Soft Target

From my IR casework, the recurring control failures in organizations like this are depressingly consistent:

• No network segmentation between clinical systems (EHR, imaging, scheduling) and corporate IT
• Backups that are online, reachable, and encrypted along with production data
• MFA absent on remote access and email, or MFA fatigue-vulnerable push notifications
• No EDR on endpoints, or EDR deployed but unmonitored after business hours
• Security awareness training treated as an annual compliance checkbox

The HIPAA Security Rule requires risk analysis and reasonable safeguards, but "reasonable" has historically been interpreted loosely for small covered entities. OCR enforcement following breaches has made clear that failing these basics is no longer defensible.

Detection & Response

The detections below target the behaviors that precede and accompany encryption events in healthcare networks. These are tuned for the attack chain described above — deploy them against your Windows/Sysmon telemetry and Sentinel workspace.

Sigma Rules

---
title: Volume Shadow Copy Deletion via vssadmin or WMI
description: Detects deletion of volume shadow copies, a hallmark pre-encryption ransomware behavior that destroys recovery options before detonation.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/02/09
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'Win32_ShadowCopy'
      - '.Delete()'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate backup administrators running shadow storage maintenance
  - Some backup software reconfigures shadowstorage during installation
level: high
---
title: Ransomware Note File Creation on Endpoints
description: Detects creation of files with names commonly used as ransomware ransom notes across multiple directories.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/02/09
status: experimental
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'DECRYPT'
      - 'RECOVER-FILES'
      - 'HOW_TO_DECRYPT'
      - 'README_FOR_DECRYPT'
      - 'RESTORE_FILES_INFO'
      - 'unlock-files'
    TargetFilename|endswith:
      - '.txt'
      - '.hta'
      - '.html'
  condition: selection
falsepositives:
  - Rare; legitimate software does not mass-create files with these names
  - Security awareness tools simulating ransomware may trigger
level: critical
---
title: Mass File Renaming with Encrypted Extension Indicator
description: Detects a single process renaming or modifying a high volume of files in a short window, consistent with ransomware mass encryption behavior.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/02/09
status: experimental
logsource:
  category: file_rename
  product: windows
detection:
  selection:
    Image|endswith:
      - '.exe'
  filter_known_legit:
    Image|startswith:
      - 'C:\\Windows\\'
      - 'C:\\Program Files\\Microsoft Office'
  condition: selection and not filter_known_legit
falsepositives:
  - Bulk file management tools, media organizers, and some sync clients
  - Tune with aggregation thresholds in your SIEM (e.g., >50 renames per process per minute)
level: high

KQL — Microsoft Sentinel / Defender Hunt

This query hunts the pre-encryption staging behaviors: shadow copy deletion, backup service tampering, and suspicious mass file operations — the last reliable detection window before detonation.

// Hunt: ransomware pre-encryption staging behaviors across endpoints
let lookback = 14d;
let stagingTerms = dynamic(["delete shadows", "shadowcopy delete", "resize shadowstorage", "bcdedit", "recoveryenabled no", "wbadmin delete catalog", "stop SQL", "net stop backup"]);
union withsource=SourceTable_
    (DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any (stagingTerms)
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName),
    (SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 4688
    | where CommandLine has_any (stagingTerms)
    | project TimeGenerated, Computer, Account, NewProcessName, CommandLine, ParentProcessName)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), EventCount=count()
    by DeviceName, AccountName, FileName, ProcessCommandLine
| sort by FirstSeen asc

Pair it with a mass-file-activity hunt for encryption-in-progress detection:

// Hunt: single process touching abnormal volume of files (encryption in progress)
DeviceFileEvents
| where TimeGenerated > ago(1d)
| where ActionType in ("FileModified", "FileRenamed")
| where InitiatingProcessFileName !in~ ("svchost.exe", "System", "MsMpEng.exe", "OneDrive.exe", "SearchIndexer.exe")
| summarize FileOps=count(), DistinctExtensions=dcount(FileExtension), SampleFolder=any(FolderPath)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(TimeGenerated, 5m)
| where FileOps > 200
| sort by FileOps desc

Velociraptor VQL — Endpoint Hunt

Use this artifact across your fleet to find active or recent shadow copy deletion and ransomware staging on Windows endpoints:

-- Hunt: shadow copy deletion and ransomware staging artifacts
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|resize shadowstorage|bcdedit.*recoveryenabled|wbadmin delete)'
   OR CommandLine =~ '(?i)(net stop.*(backup|sql|veeam|vss))'

-- Hunt: ransom note artifacts dropped across user-writable paths
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
    'C:/Users/*/Desktop/*DECRYPT*',
    'C:/Users/*/Desktop/*RECOVER*',
    'C:/Users/*/Documents/*HOW_TO_DECRYPT*',
    'C:/Users/*/Desktop/*README*DECRYPT*',
    'C:/*/*/RESTORE_FILES_INFO*'
])

Hardening Script — Backup and Recovery Verification

The single biggest determinant of whether an encryption event becomes a breach disclosure or a bad Tuesday is backup integrity. This PowerShell script audits shadow copy status, backup service health, and recovery configuration on a Windows system — run it fleet-wide via your RMM or Intune:

# Verify recovery posture: shadow copies, backup services, bcdedit recovery settings
# Run as Administrator. Output flagged items indicate ransomware-preparation risk.

Write-Host "=== Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize
} else {
    Write-Host "[ALERT] No shadow copies exist on this system." -ForegroundColor Red
}

Write-Host "`n=== Backup/Recovery-Related Service Status ===" -ForegroundColor Cyan
$backupServices = @('VSS','wbengine','swprv','VeeamBackupSvc','VeeamTransportSvc','SQLSERVERAGENT')
foreach ($svc in $backupServices) {
    $s = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($s) {
        $color = if ($s.Status -eq 'Running' -or $s.StartType -eq 'Manual') {'Green'} else {'Red'}
        Write-Host "$($s.Name): $($s.Status) / StartType: $($s.StartType)" -ForegroundColor $color
    }
}

Write-Host "`n=== Boot Recovery Configuration ===" -ForegroundColor Cyan
$bcd = bcdedit /enum '{current}' 2>$null | Out-String
if ($bcd -match 'recoveryenabled\s+No') {
    Write-Host "[ALERT] Boot recovery is DISABLED - common ransomware tampering indicator." -ForegroundColor Red
    Write-Host "Re-enable with: bcdedit /set {current} recoveryenabled Yes" -ForegroundColor Yellow
} else {
    Write-Host "Boot recovery enabled." -ForegroundColor Green
}

Write-Host "`n=== Offline Backup Reachability Check ===" -ForegroundColor Cyan
# Offline/immutable backups should NOT be reachable from production endpoints.
# Populate with your backup target paths to confirm segmentation holds.
$backupTargets = @()  # e.g. '\\backup-nas\patientbackups'
foreach ($t in $backupTargets) {
    if (Test-Path $t) {
        Write-Host "[RISK] Backup target $t is reachable from this endpoint - verify network segmentation and immutable/offline copies." -ForegroundColor Red
    }
}

Remediation and Defensive Actions for Healthcare Organizations

There is no patch for this incident — the remediation is architectural. Based on what consistently separates survivors from victims in my healthcare IR engagements, prioritize in this order:

Immediate (this week):

1. Enforce phishing-resistant MFA on all remote access, VPN, RMM tooling, and Microsoft 365. Disable legacy authentication protocols (IMAP/POP/SMTP basic auth) tenant-wide.
2. Verify your backups actually restore. Not "the backup job ran green" — perform a full restoration test of your EHR database and file shares to isolated infrastructure. Confirm at least one copy is offline or immutable (object-lock, air-gapped, or WORM storage).
3. Audit RDP and remote access exposure. Run an external scan of your own perimeter. Any RDP, VPN portal without MFA, or unpatched remote access appliance facing the internet is your most probable initial access vector.

Short term (30 days): 4. Deploy EDR with 24/7 monitoring on every endpoint and server, including after-hours alerting. Encryption events detonate at 2 AM on weekends for a reason — that's when nobody is watching. 5. Segment clinical from corporate. EHR servers, imaging systems, and medical devices must be on isolated VLANs with restrictive east-west firewall rules. Workstation-to-workstation SMB should be denied by default. 6. Deploy the detection content above. Shadow copy deletion, ransom note creation, and mass file modification alerts give you minutes to hours of response window before detonation completes.

Strategic (this quarter): 7. Conduct the HIPAA Security Rule risk analysis you may have been deferring. OCR's post-breach investigations consistently cite absent or stale risk analyses as the foundational failure. Document it, remediate the findings, and revisit annually. 8. Build and exercise an IR plan with defined decision authority: who decides to disconnect, who calls counsel, who engages your IR retainer, who notifies OCR. The 60-day HIPAA breach notification clock starts at discovery — organizations without rehearsed plans burn half of it on internal confusion. 9. Evaluate cyber insurance requirements honestly. Carriers now routinely deny claims where MFA or backup attestations were inaccurate. Your renewal questionnaire is effectively a control audit.

For Texas Hearing Institute patients specifically: affected individuals should expect notification letters, should place fraud alerts or credit freezes with the major bureaus, should scrutinize Explanation of Benefits statements for unfamiliar claims, and should treat any unsolicited contact referencing their care at the institute as a probable phishing attempt.

The Bottom Line

Thirty thousand patients at a pediatric audiology practice are now managing medical identity risk because an attacker got in, moved quietly, and encrypted. Nothing about that chain required sophistication beyond commodity tooling and an undefended perimeter. The healthcare sector's breach epidemic is not a zero-day problem — it's a fundamentals problem. MFA, segmented networks, tested offline backups, and monitored EDR would have broken this attack at multiple points. If you're a covered entity reading this, your incident isn't a matter of if. Close the basics before someone closes them for you.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub