Incident Score: Analysis & Impact (EVO1772490245)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Valid Accounts (T1078) with high confidence (90%), with evidence including former employee had access to patient records, and misused access to patient records between November 2021 and July 2024. Under the Credential Access tactic, the analysis identified Credentials from Password Stores (T1555) with moderate to high confidence (70%), supported by evidence indicating former employee misused access to sensitive data including SSNs, medical records. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating social Security numbers, medical records, insurance details, payment card information compromised and Data from Information Repositories (T1213) with moderate to high confidence (80%), supported by evidence indicating patient data accessed via internal systems by former employee. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (70%), supported by evidence indicating data allegedly sold on the dark web or used for fraud and Exfiltration Over Web Service (T1567) with moderate confidence (60%), supported by evidence indicating evidence of data misuse discovered during traffic stop. Under the Impact tactic, the analysis identified Data Destruction (T1485) with lower confidence (30%), supported by evidence indicating conflicting reports on number of affected individuals (261 vs 1,629) and Data Manipulation: Stored Data Manipulation (T1565.001) with lower confidence (40%), supported by evidence indicating discrepancy in breach reports and affected patient counts. Under the Defense Evasion tactic, the analysis identified Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (70%), supported by evidence indicating former employee used legitimate access to evade detection for years and Hide Artifacts: Hidden Files and Directories (T1564.001) with moderate confidence (50%), supported by evidence indicating breach went undetected from November 2021 to August 2025. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.