DaVita, one of the largest kidney dialysis providers in the United States, agreed to pay $15 million to settle litigation stemming from a 2025 ransomware attack. The attack resulted in the theft of sensitive patient data — protected health information (PHI) covered under HIPAA. Operations were disrupted. Patients were notified. Lawyers were paid.
This is the pattern we see over and over in healthcare: ransomware lands, encrypts files, exfiltrates patient data, and the organization spends years dealing with the legal and financial aftermath.
Here’s what most post-breach analysis misses: every one of these attacks required writing files to a Windows file system before anything bad could happen.
The Ransomware Had to Land Before It Could Encrypt
Ransomware doesn’t materialize out of thin air. It arrives via email attachment, malicious link, compromised RDP session, or software vulnerability. But regardless of the delivery method, the malware payload must be written to disk as an executable file before it can run.
That write operation — the moment the .exe, .dll, or script file lands on the file system — is the upstream choke point. It happens before encryption, before exfiltration, before any damage occurs.
FileSure Defend operates at the Windows kernel level via a filter driver. It intercepts file system operations — open, read, write, delete, create, rename — and enforces policies on those operations. You define which programs are authorized to write executable files. Everything else is blocked.
An Outlook client downloading a malicious attachment? Not authorized to write .exe files. Blocked.
A browser saving a payload from a phishing link? Not authorized. Blocked.
A compromised RDP session attempting to drop ransomware? Not authorized. Blocked.
The payload never lands. The ransomware never runs. The encryption never starts.
Example FileSure Rule: Block Executable Writes from Email and Browsers
- File name filter:
*.exe, *.dll, *.scr, *.bat, *.ps1, *.vbs - Program name filter (deny list):
outlook.exe, chrome.exe, firefox.exe, msedge.exe, iexplore.exe - Operations: Write, Create
- Drive type: All drives
- Result: Email clients and browsers cannot write executable files to disk. Legitimate file downloads (documents, images) proceed normally. Malware payloads are blocked before they land.
Bulk Encryption Detection and Containment
If an attacker somehow bypassed the executable write controls — perhaps through a zero-day exploit or a misconfigured exception — FileSure’s threshold rules provide a second layer of defense.
Ransomware encryption is not subtle. It modifies hundreds or thousands of files per minute. Normal user behavior does not. A threshold rule detects this bulk modification pattern and blocks further file operations once the threshold is crossed.
Damage is contained to the files modified before the threshold fired — typically a small fraction of the total file system.
Example FileSure Threshold Rule: Detect and Block Bulk Encryption
- File name filter:
*(all files) - Operations: Write, Rename / Move
- Drive type: Hard drives, Network drives
- Threshold: 20 file modifications within 60 minutes
- Result: Normal document editing passes without restriction. Ransomware bulk encryption crosses the threshold within seconds. Subsequent write and rename operations are blocked.
PHI Exfiltration Prevention
The DaVita breach involved data theft — patient records were exfiltrated during the attack. Exfiltration requires reading files from disk and transmitting them elsewhere.
FileSure controls which programs can read PHI files. You define the authorized applications — your EHR, PACS, laboratory system. Unauthorized programs attempting to open patient data files are blocked and logged.
An attacker’s data staging script trying to read thousands of patient records? Blocked.
A compromised user account attempting to copy PHI to a USB drive or upload it via webmail? Blocked.
The files stay where they belong.
HIPAA Compliance and Audit Trails
HIPAA’s Security Rule requires covered entities to implement access controls, audit controls, and integrity controls for PHI. FileSure provides all three.
Every file access is logged: user name, machine name, program name, operation type, timestamp, file path. The logs are encrypted, tamper-resistant, and stored separately from the files they record. Your compliance team has a complete audit trail ready for OCR review.
When the breach happened, you’ll know exactly who accessed what, when, and with which program. When the breach didn’t happen because FileSure blocked it, you’ll have that logged too.
The DaVita settlement is another data point in a long list of healthcare ransomware incidents that follow the same pattern: payload lands, files encrypt, data exfiltrates, organization pays.
FileSure Defend addresses the problem at the most upstream point — the file system operations that every attack requires. Block unauthorized executable writes. Detect bulk encryption patterns. Control access to PHI files. Log everything.
Start a free 21-day trial at bystorm.com and see how kernel-level file system control changes the math on ransomware.
Source: DaVita Agrees to Pay $15 Million to Settle Data Breach Litigation
Category: Ransomware
Tags: ransomware, healthcare data breach, hipaa, phi exfiltration, kernel filter driver, file system security, davita breach
