The Largest Healthcare Breach in History
In February 2024, ransomware operators compromised Change Healthcare and exposed the protected health information of approximately 192.7 million people — roughly two-thirds of all healthcare data exposures that year. It remains the largest health data breach in history, surpassing the 2015 Anthem breach that held the record for nine years.
According to the latest statistics, healthcare breaches cost an average of $7.42 million per incident in 2025 and take an average of 279 days to identify and contain. Change Healthcare’s impact was orders of magnitude larger — it affected claims processing for a significant portion of the United States healthcare system.
The attack followed a pattern we see repeatedly: ransomware operators gained access to the network, moved laterally across systems, and deployed encryption payloads that locked critical infrastructure. Hospitals couldn’t process claims. Pharmacies couldn’t verify prescriptions. The operational impact cascaded across the industry for weeks.
Why the Attack Worked
Ransomware requires writing files to disk before it can execute. The malware payload has to land somewhere. The encryption routine has to be written to the file system. Lateral movement across Windows networks typically involves writing files to remote shares via SMB.
Every one of those steps is a file system operation that happens before the damage starts.
Most security tools try to recognize the ransomware after it’s already on disk — signature matching, behavior analysis, sandboxing. That’s detection after delivery. By the time the payload is identified, it’s already in position to execute.
The 279-day average time to identify and contain a healthcare breach exists because organizations are looking for the attack in the wrong place, at the wrong time. They’re analyzing logs after the files are already encrypted, trying to reconstruct what happened days or weeks earlier.
How FileSure Blocks Ransomware Before Execution
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts every file system operation: open, read, write, delete, create, rename. It enforces policy before the operation completes.
A specific FileSure policy that would have stopped Change Healthcare:
Rule: Block all executable file writes to server shares from remote systems unless the source program is on an approved list (e.g., authorized deployment tools, patch management systems).
Filter: *.exe, *.dll, *.sys, *.bat, *.ps1, *.vbs, *.scr
Operations: WRITE, CREATE
Drive type: Network shares (SMB)
Action: BLOCK and LOG
When the ransomware payload attempted to write to the file system — whether during initial delivery, lateral movement, or final deployment — FileSure would have blocked the write operation and logged the attempt with the user name, machine name, program name, and timestamp.
The attack stops at delivery. The payload never lands. Encryption, exfiltration, and operational disruption never happen.
HIPAA Audit Trails That Actually Work
The article notes that OCR closed 21 enforcement actions in 2025, with missing or inadequate risk analysis under 45 CFR § 164.308(a)(1)(ii)(A) remaining the most commonly cited failure. HIPAA’s Technical Safeguard standards require covered entities to log and monitor all access to PHI.
FileSure records every file access operation on PHI files: who accessed it, when, from which machine, with which program. The logs are encrypted, tamper-resistant, and stored separately from the files they record. When OCR asks for your audit trail, it’s ready.
More importantly, those logs are generated in real time. You don’t wait 279 days to find out someone accessed files they shouldn’t have. You know immediately, because FileSure logged the attempt and blocked it if the access violated policy.
Start Your Free Trial
FileSure Defend runs on all Windows versions — including the legacy systems that much of healthcare infrastructure depends on. Medical imaging systems, laboratory equipment, pharmacy systems running older Windows versions that modern security tools won’t touch.
If your organization handles PHI, you need kernel-level file system controls and real-time audit trails. Start your free 21-day trial at bystorm.com.
Source: Healthcare Data Breach Statistics 2026: HIPAA Enforcement | HIPAA Compliant Hosting
Category: Ransomware
Tags: change healthcare, ransomware, hipaa, phi protection, kernel filter driver, file system security, healthcare breach, blackcat ransomware
