# HHS OCR Settles Ransomware Investigation of Lehigh Valley Health Network (ALPHV/BlackCat)

> HHS Office for Civil Rights settled a HIPAA investigation of Lehigh Valley Health Network (LVHN) over a February 2023 ALPHV/BlackCat ransomware breach that exposed PHI of 248,359 individuals. LVHN agreed to an $800,000 payment and a three-year corrective action plan; the separate patient class action settled for $65 million.

- **Published:** 2026-11-03T22:44:55Z
- **Last reviewed:** 2026-11-03T22:44:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5184
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5184.png
- **ID:** TL-2026-5184
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** RESOLVED
- **Actor:** ALPHV (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)

## Description

Lehigh Valley Health Network identified suspicious activity on its network on February 6, 2023 and later confirmed ransomware was involved. The ALPHV/BlackCat group breached parts of the network, specifically IT systems related to Delta Medix, a physician group LVHN acquired in 2021. The affected system supported one physician practice in Lackawanna County and held clinically appropriate patient images for radiation oncology treatment and other sensitive information. LVHN publicly disclosed the attack on February 20, 2023 and stated that operations were not disrupted. It also said it refused to pay the ransom. A reported demand of $22 million appears in secondary coverage only.

After LVHN refused payment, ALPHV published stolen data on its dark-web leak site in early March 2023. The leaked material included clinical photographs of breast cancer patients undergoing radiation treatment, which the gang described as nude photos to intensify the extortion. It also included other personal information such as passport scans and questionnaires. The case illustrates double-extortion tactics against healthcare, where patient-image data is used as leverage.

Alleged failures: after the investigation, HHS OCR alleged that LVHN failed to conduct a comprehensive and accurate risk analysis to identify risks and vulnerabilities to electronic PHI (a Security Rule violation) and failed to implement procedures for regularly reviewing records of information system activity. Secondary reporting also states OCR cited untimely breach notifications; this is not confirmed against the HHS release, which returned HTTP 403 to fetch. The resolution is an $800,000 payment and a corrective action plan requiring a comprehensive, accurate risk analysis, with OCR monitoring compliance for three years. OCR counted it as its 22nd ransomware enforcement action. The PHI of 248,359 individuals was involved per OCR. The civil class action, covering about 134,000 people, settled separately for $65 million in 2024.

Generic ALPHV/BlackCat TTPs and IOCs come from the CISA/FBI advisory AA23-353A and are not confirmed to be specific to the LVHN intrusion. No CVE was cited for this incident, and no incident-specific IOCs have been published. BeaconBeagle lookups for the advisory C2 IPs returned HTTP 502 and could not be completed. This record is primarily an enforcement and compliance development.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1586 Compromise Accounts
- T1078 Valid Accounts
- T1136.002 Domain Account
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1558 Steal or Forge Kerberos Tickets
- T1557 Adversary-in-the-Middle
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1567.002 Exfiltration to Cloud Storage
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ALPHV/BlackCat Evilginx2 AiTM Session Token Replay — Initial Access** (`TL-2026-5184-SPL-001`)

TL-2026-5184 (ALPHV/BlackCat, LVHN). CISA AA23-353A documents ALPHV affiliates using Evilginx2 adversary-in-the-middle phishing to steal MFA-satisfied session tokens, then replaying them as valid accounts. This search finds successful MFA sign-ins where the same user appears from 2+ IPs with 2+ user agents inside 30 minutes, or where Entra ID Identity Protection raised attackerinTheMiddle / anomalousToken / tokenIssuerAnomaly risk. The TTP is generic ALPHV tradecraft, not confirmed for the LVHN intrusion.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1557, T1078, T1586
- **Data sources:** azure_ad_signin_logs, azure:monitor:aad, entra_identity_protection
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=azure sourcetype="azure:monitor:aad" category=SignInLogs properties.status.errorCode=0 earliest=-24h
| rename "properties.userPrincipalName" as user, "properties.ipAddress" as src_ip, "properties.userAgent" as user_agent, "properties.appDisplayName" as app, "properties.authenticationRequirement" as auth_req, "properties.riskEventTypes_v2{}" as risk_types
| where auth_req="multiFactorAuthentication"
| bin _time span=30m
| stats dc(src_ip) as ip_count dc(user_agent) as ua_count values(src_ip) as src_ips values(user_agent) as user_agents values(app) as apps values(risk_types) as risk_types by _time user
| where (ip_count>=2 AND ua_count>=2) OR match(mvjoin(risk_types,","),"(?i)attackerinTheMiddle|anomalousToken|tokenIssuerAnomaly")
| eval detection="TL-2026-5184 ALPHV Evilginx2 AiTM token replay (T1557 T1078)"
| table _time user src_ips user_agents apps risk_types detection
```

### Microsoft KQL

```kql
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0 and AuthenticationRequirement == "multiFactorAuthentication"
| extend RiskTypes = tostring(RiskEventTypes_V2)
| summarize IpCount = dcount(IPAddress), UaCount = dcount(UserAgent), IPs = make_set(IPAddress, 10), UserAgents = make_set(UserAgent, 10), Apps = make_set(AppDisplayName, 10), RiskTypes = make_set(RiskTypes, 10) by UserPrincipalName, bin(TimeGenerated, 30m)
| where (IpCount >= 2 and UaCount >= 2) or tostring(RiskTypes) matches regex @"(?i)attackerinTheMiddle|anomalousToken|tokenIssuerAnomaly"
| project TimeGenerated, UserPrincipalName, IpCount, UaCount, IPs, UserAgents, Apps, RiskTypes
```

### Sigma

```yaml
title: Entra ID Successful Sign-In With Adversary-in-the-Middle Risk Signal (ALPHV Evilginx2)
id: 5184a001-1f3c-4b7e-9a10-0a1b2c3d4e01
status: experimental
description: Detects successful Entra ID sign-ins flagged by Identity Protection with attackerinTheMiddle, anomalousToken or tokenIssuerAnomaly risk, the footprint of Evilginx2 style session token theft used by ALPHV affiliates per CISA AA23-353A (TL-2026-5184).
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.credential_access
    - attack.t1557
    - attack.initial_access
    - attack.t1078
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        ResultType: 0
        RiskEventTypes_V2|contains:
            - 'attackerinTheMiddle'
            - 'anomalousToken'
            - 'tokenIssuerAnomaly'
    condition: selection
falsepositives:
    - Legitimate users roaming between VPN and mobile networks can raise anomalousToken
    - Authorized red-team phishing simulations using Evilginx2
level: high
```

**Known false positives:**

- Users switching between corporate VPN, mobile hotspot and a second device within 30 minutes
- Authorized phishing simulations or red-team engagements using Evilginx2

**Tuning notes:** Exclude corporate VPN egress ranges and known mobile carrier ASNs, and restrict to privileged or remote-access-enabled accounts first. Raise the 30m window or the ip_count threshold if noisy; treat any Identity Protection attackerinTheMiddle hit as high priority regardless of the thresholds.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Help-Desk Credential/MFA Reset Followed by Sign-In From New IP — ALPHV Social Engineering (locked: unlock with TL Creds)
- Kerberoasting — RC4 TGS Request Burst Across Multiple SPNs (ALPHV Credential Access) (locked: unlock with TL Creds)
- Data Exfiltration to [indicator] / Dropbox by Non-Browser Process — ALPHV Double Extortion (locked: unlock with TL Creds)
- ALPHV Affiliate Remote Access Tool Installation — ScreenConnect, SimpleHelp, AnyDesk (locked: unlock with TL Creds)
- ALPHV Pre-Encryption Defense Impairment, Log Clearing and Ransom Note Creation (locked: unlock with TL Creds)
- ALPHV C2 Tunneling and Beacon Tooling — Plink, Ngrok, Fake conhost.exe, Cobalt Strike Pipes (locked: unlock with TL Creds)
- ALPHV Persistence — Rogue Domain Account 'aadmin' and Privileged Group Add (locked: unlock with TL Creds)
- ALPHV C2 Infrastructure Contact — CISA AA23-353A IPs/Domains and Community Siblings (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `5.199.168[.]24`
- Domain: `resources[.]docusong[.]com`
- File hash: `944153fb9692634d6c70899b83676575`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [HHS OCR settles ransomware investigation of Lehigh Valley Health Network](https://www.hhs.gov/press-room/hhs-ocr-settles-ransomware-investigation-lehigh-valley-health-network.html)
- [DataBreaches.net: HHS Office for Civil Rights settles ransomware investigation of Lehigh Valley Health Network](https://databreaches.net/2026/11/03/hhs-office-for-civil-rights-settles-ransomware-investigation-of-lehigh-valley-health-network/)
- [HIPAA Journal: Lehigh Valley Health Network BlackCat settlement](https://www.hipaajournal.com/lehigh-valley-health-network-blackcat-settlement/)
- [Lehigh Valley Health Network says it was target of cyberattack by ransomware gang BlackCat](https://www.lehighvalleypublicmedia.org/health-news/2023-02-20/lehigh-valley-health-network-says-it-was-target-of-russian-ransomware-gang-blackcat)
- [Malwarebytes: Breast cancer photos published by ransomware gang](https://www.malwarebytes.com/blog/news/2023/03/breast-cancer-photos-published-by-ransomware-gang)
- [CISA/FBI Advisory AA23-353A: #StopRansomware: ALPHV Blackcat](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a)
- [Insurance Journal: Lehigh Valley Health Network $65M class action settlement](https://www.insurancejournal.com/news/east/2024/09/12/792600.htm)
- [Bank Info Security: Pennsylvania Health System CEO Confirms BlackCat Attack](https://www.bankinfosecurity.net/pennsylvania-health-system-ceo-confirms-blackcat-attack-a-21279)
- [6abc: LVHN images of cancer patients posted on dark web after cyberattack](https://6abc.com/amp/post/lehigh-valley-health-network-cyberattack-dark-web-stolen-documents/12926619/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5184