What Happened at MCBS
MCBS, LLC, a Georgia-based healthcare management and revenue cycle management company, just disclosed a cybersecurity incident affecting 1.26 million individuals. While the full details are still emerging, this is the nightmare scenario for any organization handling protected health information: over a million patient records potentially compromised, HIPAA breach notification requirements triggered, and the reputational damage that comes with it.
Healthcare management companies face a specific challenge. They handle billing, claims, and patient data across multiple healthcare facilities. That means PHI distributed across numerous systems, accessed by various applications, and often stored on infrastructure that’s been running reliably for years — sometimes on Windows versions that are no longer supported by mainstream security vendors.
Why Legacy Healthcare Systems Are Vulnerable
The uncomfortable truth about healthcare IT: a significant portion of medical infrastructure runs on older Windows versions because the specialized software won’t run on anything newer. Medical imaging systems, laboratory equipment, pharmacy management systems — these aren’t neglected. They’re doing critical work. They just weren’t built for the current threat environment.
Modern endpoint security tools won’t install on those systems. So they sit on your network, handling patient data, unprotected by the tools your security team deploys everywhere else.
Whether the MCBS incident involved ransomware that encrypted patient data or malware that exfiltrated it, the attack required file system operations: either writing executable payloads to disk, or reading PHI files to steal them. Those operations happen at the kernel level, regardless of what application or exploit delivered them.
How FileSure Prevents PHI Breaches
FileSure operates at the Windows kernel file system layer via a filter driver. It intercepts every file operation — open, read, write, create, delete, rename — before it reaches the file system.
For a healthcare organization, the protection is straightforward:
Ransomware prevention: Block unauthorized programs from writing executable files to disk. The rule is simple: these programs are not allowed to create .exe, .dll, .bat, or script files. Ransomware that never lands on disk never executes. No encryption, no lateral movement, no breach.
Data exfiltration prevention: Define which applications are authorized to open files containing PHI. Your EHR system, your billing software, your authorized backup tool — those can read patient data. Email clients, browsers, file sync utilities — blocked. An employee with legitimate access to patient records can still do their job. They just can’t copy those records to a USB drive, upload them via webmail, or sync them to personal cloud storage.
HIPAA audit compliance: Every access to a PHI file is logged: user name, program name, machine name, operation type, timestamp, file path. The logs are encrypted, tamper-resistant, and stored separately from the files they record. Your audit trail survives even if the systems get compromised.
A specific FileSure rule configuration for a healthcare environment might look like:
- File filter:
*.hl7, *.xml, *.csv, *.pdf(common PHI data formats) - Authorized programs:
C:\Program Files\EHR\*.exe, C:\Backup\*.exe - Blocked operations: WRITE, CREATE (from unauthorized programs)
- Drive types: Fixed, Removable, Network
- Action: Block and log
FileSure runs on legacy and modern Windows systems. If your medical device is running Windows XP embedded or Windows 7 because that’s what the vendor certified, FileSure still protects it. Your compliance doesn’t stop at the edge of your modern infrastructure.
The Bottom Line
The tools exist to protect healthcare data on the systems you actually have, not just the ones the security industry wishes you had.
Start a free 21-day trial at bystorm.com and see how kernel-level file system security works on your environment — legacy systems included.
Source: MCBS Announces Cybersecurity Incident Impacting 1.26M Individuals
Category: Data Loss Prevention
Tags: healthcare breach, hipaa compliance, phi protection, legacy systems, kernel filter driver, data exfiltration, mcbs, healthcare security
