UltraMobile Imaging Breach Exposes 75,000 Patients: Detection and Hardening Guide for Healthcare Defenders

UltraMobile Imaging, a New York-based mobile diagnostic imaging provider, has disclosed a data breach impacting approximately 75,000 individuals, according to reporting by The HIPAA Journal. The same disclosure cycle includes breach notifications from Artistic Smiles in Colorado and Parkview Health in Indiana — a reminder that healthcare remains one of the most consistently targeted sectors for data theft, and that breaches are rarely isolated events. They cluster because attackers cluster their targeting.

While the public notifications provide limited technical detail on the intrusion vector — a common reality in HIPAA breach disclosures, where regulatory timelines force notification before forensic investigations fully conclude — the pattern is familiar to anyone who has led healthcare IR engagements: unauthorized access to systems housing protected health information (PHI), a dwell period during which data is staged and exfiltrated, and detection that arrives weeks or months after initial compromise.

For defenders, the actionable question is not "how did UltraMobile Imaging get in" — it's "would we detect the same behaviors in our environment?" This post breaks down the attack patterns typical of healthcare PHI theft, provides detection content you can deploy today, and lays out a hardening roadmap grounded in HIPAA Security Rule requirements and real-world IR experience.

Technical Analysis

What We Know

Per The HIPAA Journal's reporting:

• UltraMobile Imaging (New York): Approximately 75,000 individuals affected. As a mobile imaging provider, the organization handles diagnostic imaging data — X-rays, ultrasounds, and related studies — alongside the demographic and insurance data attached to every patient encounter. Imaging providers are particularly attractive targets because their systems (PACS, DICOM archives, scheduling and billing platforms) aggregate high volumes of complete patient identity records.
• Artistic Smiles (Colorado): A dental practice breach — small healthcare entities continue to be hit disproportionately because they typically lack dedicated security staff and rely on under-resourced MSPs.
• Parkview Health (Indiana): A large regional health system, demonstrating that organizational size and security budget are no guarantee of immunity.

The Typical Attack Chain in Healthcare PHI Theft

In the absence of published forensic detail for these specific incidents, defenders should model against the intrusion pattern we consistently observe in healthcare breach investigations:

1. Initial Access: Phishing (T1566) against clinical or administrative staff, or exploitation of externally exposed remote access (RDP, VPN appliances, unpatched remote management tooling). Smaller providers frequently inherit risk through their MSP or billing vendor — supply-chain compromise of a shared service provider is a leading cause of clustered healthcare disclosures like the ones in this report.
2. Persistence and Credential Access: Deployment of web shells on internet-facing servers, creation of local admin accounts, and credential dumping from memory (T1003) to enable lateral movement toward data stores.
3. Collection: Attackers locate and stage PHI — database dumps from SQL Server hosting EHR/billing data, file shares containing scanned documents, or exports from PACS/DICOM archives. Staging almost always involves archive creation (T1560.001) using tools like 7-Zip, WinRAR, or tar in staging directories such as C:\ProgramData, C:\Users\Public, or C:\Windows\Temp.
4. Exfiltration: Bulk transfer to attacker-controlled cloud storage (MEGA, Dropbox, Google Drive) via tools like Rclone, or direct exfiltration over HTTPS/SSH (T1567.002, T1048). Healthcare breaches routinely involve hundreds of gigabytes moving outbound — a signal most organizations are not monitoring.
5. Discovery Lag: The defining feature of these incidents. HIPAA's 60-day notification clock starts at discovery, and discovery frequently comes from external sources — law enforcement, threat actor leak sites, or the attacker's own extortion contact — rather than internal detection.

Why Imaging Providers Are High-Value Targets

Mobile imaging and diagnostic providers present a specific risk profile defenders should understand:

• Aggregated data without hospital-grade defenses. They hold hospital-scale PHI volumes but operate with clinic-scale security budgets.
• Legacy medical technology. PACS servers and DICOM nodes frequently run outdated operating systems that cannot support modern EDR, and segmentation between the imaging VLAN and corporate IT is often weak or absent.
• Broad connectivity. Mobile providers maintain VPN or portal connections to dozens of referring practices and facilities — every one of those trust relationships is a potential ingress path.

Exploitation Status

No CVE has been publicly associated with these breaches as of this writing, and no threat actor has been formally attributed in the public reporting. This is consistent with the majority of healthcare breach disclosures, where the vector is disclosed only in regulatory filings or never publicly detailed. Defenders should treat this as a capability-gap exercise: assume the intrusion succeeded through a common vector (phishing, exposed remote access, or a third party) and validate your detection coverage against the post-compromise behaviors below.

Detection & Response

The detections below target the post-compromise behaviors that are nearly universal in healthcare PHI theft: archive staging, mass exfiltration tooling, and anomalous access to imaging systems. They are tuned to fire on attacker tradecraft, not routine clinical operations.

Sigma Rules

The first rule detects archive-creation tools executing against staging directories or with password-protection flags — a near-universal precursor to exfiltration. The second detects Rclone and similar exfiltration utilities, which have no legitimate presence in most clinical environments. The third targets network connections from DICOM/PACS infrastructure to non-routine destinations, which should be one of the lowest-noise, highest-fidelity alerts in a healthcare SOC because imaging nodes should only ever talk to a small, known set of peers.

---
title: Archive Staging in Suspicious Directories — PHI Theft Precursor
id: 8c2f4b91-3d6e-4a7f-b5c9-2e1a6d8f3b47
status: experimental
description: Detects compression/archive utilities executing with password protection or from staging directories commonly used by attackers to package PHI prior to exfiltration. Observed across healthcare breach intrusions.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.hipaajournal.com/ultramobile-imaging-artistic-smiles-parkview-health-data-breaches/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_suspicious:
    CommandLine|contains:
      - 'C:\ProgramData\'
      - 'C:\Users\Public\'
      - 'C:\Windows\Temp\'
      - ' -p'
      - ' -hp'
      - '/p'
  condition: selection_tool and selection_suspicious
falsepositives:
  - Legitimate IT backup or archiving scripts — whitelist known admin account and scheduled task combinations
level: high
---
title: Exfiltration Tool Execution — Rclone and Cloud Sync Utilities
id: 3f7a2c85-91e4-4b6d-a8c2-5d9f1e3b7a24
status: experimental
description: Detects execution of Rclone and similar command-line cloud transfer tools frequently used to exfiltrate staged PHI to attacker-controlled cloud storage in healthcare breaches.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://rclone.org/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\MEGAsync.exe'
  selection_cli:
    CommandLine|contains:
      - 'rclone copy'
      - 'rclone move'
      - 'rclone sync'
      - '--transfers'
      - 'mega:'
  condition: selection_img or selection_cli
falsepositives:
  - Rare legitimate cloud backup usage — if your organization has no sanctioned rclone deployment, treat every hit as an incident
level: critical
---
title: DICOM/PACS Host Inbound Connection from Non-Clinical Segment
id: 5b9e1d47-2c8f-4a3b-9e6d-7f2a4c1b8e35
status: experimental
description: Detects inbound connections to DICOM ports (104, 2761, 2762, 11112) from workstation or user segments. Imaging servers should only accept DICOM associations from known modalities and radiology workstations — lateral movement toward PACS is a strong PHI-theft indicator.
references:
  - https://attack.mitre.org/techniques/T1021/
  - https://attack.mitre.org/tactics/TA0009/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.lateral_movement
  - attack.collection
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 104
      - 2761
      - 2762
      - 11112
    Initiated: 'false'
  filter_known_peers:
    SourceIp|cidr:
      - '10.50.0.0/16'
  condition: selection and not filter_known_peers
falsepositives:
  - Newly deployed modalities or PACS migrations — maintain an accurate CMDB of authorized DICOM peers and update the filter accordingly
level: high

Note on tuning: Rule three's filter_known_peers CIDR is a placeholder — replace it with your actual imaging VLAN ranges before deployment. A PACS server receiving DICOM associations from a user subnet is exactly the kind of alert that justifies paging someone at 2 AM.

KQL Hunt — Microsoft Sentinel / Defender

This query hunts for the staging-to-exfiltration sequence across both endpoint and network telemetry: compression tool execution on servers, followed by large outbound transfers from the same device within a 24-hour window. It is designed to surface the "low and slow" exfiltration pattern where attackers move staged archives out over hours or days.

// Hunt: Archive staging followed by anomalous outbound transfer volume (healthcare PHI exfil pattern)
let lookback = 14d;
let staging = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("7z.exe","7za.exe","rar.exe","winrar.exe","rclone.exe")
   or ProcessCommandLine has_any ("rclone copy","rclone sync","rclone move"," -p"," -hp")
| summarize StagingFirstSeen=min(TimeGenerated), StagingCmds=make_set(ProcessCommandLine, 5) by DeviceName, DeviceId;
let exfil = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| summarize OutboundConns=count(), UniqueDestinations=dcount(RemoteIP), Destinations=make_set(RemoteUrl, 10)
   by DeviceName, bin(TimeGenerated, 1h);
staging
| join kind=inner exfil on DeviceName
| where TimeGenerated between (StagingFirstSeen .. StagingFirstSeen + 24h)
| project DeviceName, StagingFirstSeen, StagingCmds, ExfilWindow=TimeGenerated, OutboundConns, UniqueDestinations, Destinations
| order by UniqueDestinations desc;

For environments ingesting firewall logs via CEF/Syslog, this companion query flags any single internal host moving more than 5 GB outbound in a day — a threshold that catches bulk PHI exfiltration while sparing routine medical image inbound traffic:

// Hunt: Hosts exceeding 5GB daily outbound to external destinations (CommonSecurityLog / firewall)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where SentBytes > 0
| extend IsInternal = SourceIP startswith "10." or SourceIP startswith "192.168."
| where IsInternal
| summarize TotalSentGB=round(sum(SentBytes)/1073741824.0, 2), Destinations=make_set(DestinationIP, 20)
   by SourceIP, SourceHostName, bin(TimeGenerated, 1d)
| where TotalSentGB > 5
| order by TotalSentGB desc;

Velociraptor VQL

For IR scoping on a suspected host, this artifact pulls the forensic triad for exfiltration investigations: active exfil-tool processes, recently created archives in staging directories, and established external connections from non-browser processes.

-- Artifact: Healthcare.ExfilTriage
-- Purpose: Triage a host for PHI staging and exfiltration artifacts
-- Deploy via Velociraptor hunt across imaging servers, file servers, and SQL/EHR hosts

SELECT * FROM {
  -- 1. Running archive/exfil tools
  SELECT 'proc' AS ArtifactType, Pid AS Id, Name, CommandLine AS Detail, Exe AS Path, Username
  FROM pslist()
  WHERE Name =~ '(?i)(7z|7za|rar|winrar|rclone|megacmd|filezilla|winscp)'
} UNION {
  -- 2. Recently created archives in common staging locations (last 30 days)
  SELECT 'archive' AS ArtifactType, 0 AS Id, Name, Size AS Detail, FullPath AS Path, Mtime AS Username
  FROM glob(globs=[
    'C:/ProgramData/**/*.zip',
    'C:/ProgramData/**/*.7z',
    'C:/ProgramData/**/*.rar',
    'C:/Users/Public/**/*.zip',
    'C:/Users/Public/**/*.7z',
    'C:/Windows/Temp/**/*.zip',
    'C:/Windows/Temp/**/*.7z'
  ])
  WHERE Mtime > now() - (30 * 24 * 3600)
} UNION {
  -- 3. Established external connections from non-browser processes
  SELECT 'conn' AS ArtifactType, Pid AS Id, Name,
         (RemoteAddr.IP + ':' + format(format='%d', args=RemoteAddr.Port)) AS Detail,
         '' AS Path, Status AS Username
  FROM netstat()
  WHERE Status = 'ESTABLISHED'
    AND RemoteAddr.IP !~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)'
    AND Name !~ '(?i)(chrome|msedge|firefox|iexplore)'
}

Remediation and Hardening Script

This PowerShell script performs three functions on servers handling PHI (file servers, PACS gateways, SQL hosts): it audits for the presence of unsanctioned exfiltration tooling, reports on archive files in staging directories older than 24 hours (leftover staging is a post-incident artifact worth hunting), and validates that outbound firewall restrictions are in place on server VLANs.

#requires -RunAsAdministrator
# Security Arsenal — Healthcare PHI Exfil Surface Audit
# Run on file servers, PACS/DICOM gateways, and EHR/SQL hosts. Review output; do not auto-remediate in production.

$Report = @()

# --- 1. Scan for unsanctioned exfiltration/archiving tools ---
Write-Host "[1] Scanning for exfiltration tooling..." -ForegroundColor Cyan
$ToolPaths = @(
    "$env:ProgramFiles", "${env:ProgramFiles(x86)}",
    "$env:ProgramData", "$env:SystemDrive\Users"
)
$SuspectTools = Get-ChildItem -Path $ToolPaths -Recurse -Include 'rclone.exe','megacmd.exe','MEGAsync.exe','7z.exe','rar.exe' -ErrorAction SilentlyContinue |
    Where-Object { $_.FullName -notmatch '7-Zip|WinRAR' }  # exclude sanctioned install dirs
foreach ($t in $SuspectTools) {
    $Report += [pscustomobject]@{ Finding='ExfilTool'; Path=$t.FullName; Detail="Review for legitimacy; hash: $((Get-FileHash $t.FullName -ErrorAction SilentlyContinue).Hash)" }
}

# --- 2. Find archives in staging directories modified in last 30 days ---
Write-Host "[2] Hunting staged archives..." -ForegroundColor Cyan
$StagingDirs = @("$env:ProgramData", "$env:SystemDrive\Users\Public", "$env:WINDIR\Temp")
$Archives = Get-ChildItem -Path $StagingDirs -Recurse -Include '*.zip','*.7z','*.rar','*.tar.gz' -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) -and $_.Length -gt 50MB }
foreach ($a in $Archives) {
    $Report += [pscustomobject]@{ Finding='StagedArchive'; Path=$a.FullName; Detail="Size: $([math]::Round($a.Length/1MB)) MB, Modified: $($a.LastWriteTime)" }
}

# --- 3. Verify egress restriction rules exist for server outbound traffic ---
Write-Host "[3] Checking egress firewall posture..." -ForegroundColor Cyan
$EgressRules = Get-NetFirewallRule -Direction Outbound -Action Block -Enabled True -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Server-Egress|Block-Outbound' }
if (-not $EgressRules) {
    Write-Host "    WARNING: No server egress block policy found. Servers should not have unrestricted internet access." -ForegroundColor Yellow
    $Report += [pscustomobject]@{ Finding='EgressGap'; Path='Firewall Policy'; Detail='No outbound restriction rules detected — create default-deny egress policy for server VLANs' }
    # Example baseline (review before enabling — comment out until validated):
    # New-NetFirewallRule -DisplayName "Server-Egress-Allow-HTTP-S" -Direction Outbound -RemotePort 80,443 -Action Allow
    # New-NetFirewallRule -DisplayName "Server-Egress-Default-Deny" -Direction Outbound -Action Block
}

$Report | Format-Table -AutoSize | Out-String | Write-Host
$Report | Export-Csv -Path "$env:TEMP\PHI_Exfil_Audit_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "Audit complete. $($Report.Count) findings written to $env:TEMP" -ForegroundColor Green

Remediation

There is no patch for a breach that has already occurred — but there is a disciplined response and hardening sequence that every healthcare organization should execute against, using these disclosures as the forcing function:

Immediate (24-72 hours):

1. Deploy the detections above. The Sigma rules, KQL hunts, and VQL triage artifact target behaviors, not indicators — they remain valid regardless of the specific intrusion vector used against UltraMobile Imaging, Artistic Smiles, or Parkview Health.
2. Audit outbound transfer volume. Pull 30 days of egress data per host from your firewall or proxy. Any server moving more than a few GB/day externally warrants investigation. Healthcare breaches are discovered late; retroactive hunting is how you find out whether you're already in the same position.
3. Inventory third-party access. Enumerate every MSP, billing vendor, and referring-facility VPN trust. Clustered disclosures like these frequently trace back to a shared service provider. Require MFA attestations and least-privilege validation from each.

Short term (30 days):

4. Enforce phishing-resistant MFA on all remote access, email, and administrative interfaces — FIDO2 or certificate-based where possible. Credential phishing remains the top initial access vector in healthcare.
5. Segment imaging infrastructure. PACS servers and DICOM nodes should sit in a dedicated VLAN that accepts connections only from an explicit allowlist of modalities and radiology workstations, with no direct internet egress. The third Sigma rule above gives you the detection; segmentation gives you the prevention.
6. Implement default-deny egress on server VLANs. Servers delivering clinical services have almost no legitimate need for unrestricted outbound internet access. This single control breaks the exfiltration stage of most PHI theft operations.

Structural (90 days and ongoing):

7. Close the discovery gap. If your mean time to detect is measured in weeks, you are one intrusion away from a 75,000-record notification. Deploy EDR on every supported endpoint and server, centralize logs in a SIEM with at least 12 months of retention, and ensure someone is actually watching the alerts — in-house or via an MDR partner.
8. Align to HIPAA Security Rule and NIST CSF 2.0. Map your controls to the HIPAA Security Rule's technical safeguards (45 CFR §164.312) — access control, audit controls, integrity, and transmission security — and conduct a documented Security Risk Analysis. OCR's enforcement posture makes clear that a breach combined with a stale or absent risk analysis is where penalties compound.
9. Tabletop the breach-notification workflow. HIPAA requires notification to affected individuals within 60 days of discovery, and to HHS (and media, for breaches of 500+) on defined timelines. Rehearse the legal, communications, and forensic coordination now — not during an active incident.

For affected individuals: the standard guidance applies — enroll in the offered credit monitoring, place fraud alerts or credit freezes with the three bureaus, and treat any unsolicited contact referencing your medical care with heightened suspicion. Medical identity theft has a longer tail than financial fraud; explanation-of-benefits statements deserve the same scrutiny as bank statements.

Conclusion

The UltraMobile Imaging disclosure — 75,000 patients, one mobile imaging provider, disclosed alongside dental and hospital-system breaches in the same news cycle — is not an anomaly. It is the baseline tempo of healthcare targeting in 2026. The organizations that avoid becoming the next headline are not the ones with the biggest budgets; they are the ones that detect post-compromise behavior in hours instead of months, restrict where their servers can send data, and treat third-party trust as an attack surface rather than an assumption.

If you cannot answer, right now, how much data your imaging servers sent to the internet last week — that is the gap to close first.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub