The February 2024 Change Healthcare attack is the largest healthcare ransomware event in US history. ALPHV/BlackCat encrypted systems across the network, stole data on 190 million people, and extracted a $22 million ransom payment from UnitedHealth Group. Thousands of providers couldn’t process claims. Pharmacies couldn’t fill prescriptions. 80% of practices surveyed by the AMA lost revenue from unpaid claims.
The attack succeeded because ransomware had permission to write to the file system.
Ransomware Requires Writing Files to Disk
Ransomware works by encrypting your files and writing the encrypted versions back to your hard drive. That’s not one possible technique — it’s the only way encryption-based ransomware functions. The malware reads your original file, encrypts it, writes the encrypted version to disk, and deletes the original.
Every one of those operations — read, write, delete — happens at the Windows file system layer.
FileSure Defend operates at exactly that layer. It’s a kernel filter driver that intercepts file operations before they complete. You define a policy: unauthorized programs cannot write executable files to this system. Ransomware attempts to write its payload or encrypted files — it’s not on the authorized list — and the write operation is blocked at the kernel.
The ransomware never executes. Your files are never encrypted.
For Change Healthcare, a FileSure policy would have looked like this:
Operation: Block WRITE, CREATE
File filter: *.exe, *.dll, *.bat, *.ps1, or * (all files)
Program filter: NOT [authorized application list]
Action: Block and log
The ALPHV payload would have been stopped the moment it tried to write encrypted files to disk. No signature update required. No waiting for a vendor to recognize the threat. The attack ends before encryption starts.
The Legacy System Problem
The article raises a harder issue: legacy medical systems that can’t be patched. An MRI scanner certified on Windows XP often can’t be upgraded without the manufacturer revalidating it. WannaCry hit the NHS in 2017 by exploiting unpatched Windows 7 systems. Canceled appointments, diverted ambulances, and locked-out patient records followed within hours.
Modern endpoint security tools won’t install on those systems. FileSure runs on Windows Server 2003 through Server 2022. If you have medical imaging equipment, lab systems, or pharmacy platforms locked to an older Windows version, FileSure protects them — without requiring patches, without requiring the vendor’s cooperation, without replacing the system.
HIPAA Compliance and Audit Trails
The HHS Office for Civil Rights treats a ransomware attack as a presumed HIPAA breach unless proven otherwise. That starts a 60-day notification clock.
FileSure logs every file access: who accessed it, when, from which machine, with which program. Logs are encrypted, tamper-resistant, and ready for your compliance team or an OCR audit. You have the access controls (restrict PHI to authorized applications), audit controls (complete record of all file access), and integrity controls (detect unauthorized modification) that HIPAA’s Security Rule requires.
The article’s conclusion is that offline backups, MFA, and network segmentation are the three controls with the highest return. Those are all correct. But they operate after the ransomware has already landed on your system. FileSure stops the attack one step earlier — at the point where the payload tries to write to disk.
Ransomware can’t encrypt files it can’t write to.
Start a free 21-day trial at bystorm.com and test it on your own systems. Download our harmless test file that mimics ransomware behavior, run it, and watch FileSure block it in real time.
Source: Healthcare ransomware: Risks, major attacks and how to prevent them
Category: Ransomware
Tags: change healthcare, alphv, wannacry, healthcare ransomware, hipaa compliance, kernel filter driver, legacy medical systems, file system security
