When The Gentlemen ransomware group exfiltrated data from Nutex Health's servers in August 2026, the Houston-based healthcare company faced a significant cybersecurity incident. The attack followed a familiar pattern: unauthorized access, data theft, and threats to publish stolen patient, employee, and business information. For security engineers, this incident underscores a critical reality: ransomware-as-a-service operations don't just encrypt files anymore. They weaponize your data.
This guide provides the technical and procedural framework to prepare for, detect, and respond to RaaS attacks targeting healthcare infrastructure.
What This Guide Covers
This field guide addresses the security engineering response to ransomware-as-a-service attacks involving data exfiltration. It covers:
- Detection and containment procedures required under HIPAA Security Rule § 164.308(a)(6)
- Forensic investigation steps that support Breach Notification Rule compliance
- Technical controls that satisfy Security Rule § 164.312 safeguards
- Documentation requirements for SEC Item 1.05 and HIPAA breach reporting
This guide does NOT cover ransom negotiation, cyber insurance claims, or legal strategy. Those require counsel and executive decision-making.
Key Concepts and Definitions
Ransomware-as-a-Service (RaaS): A criminal business model where ransomware developers license their malware to affiliates who conduct attacks. The Gentlemen, which emerged in mid-2025 and targeted healthcare in approximately 9% of its attacks, operates this model.
Double Extortion: The tactic of both encrypting files and exfiltrating data, then threatening to publish stolen information if ransom isn't paid. This transforms every RaaS attack into a potential HIPAA breach.
Material Cybersecurity Incident: Under SEC rules, an incident likely to materially impact business operations, financial condition, or results. Nutex's August 31, 2026 Form 8-K filing reclassified its incident to this status after confirming data exfiltration.
Containment Measures: Technical actions taken to isolate compromised systems, prevent lateral movement, and stop ongoing data exfiltration. These must be documented under Security Rule § 164.308(a)(6)(i).
Requirements Breakdown
HIPAA Security Rule § 164.308(a)(6) - Security Incident Procedures
You must implement procedures to identify, respond to, report, and mitigate security incidents. This includes:
- Real-time monitoring for unauthorized access attempts
- Documented escalation paths from detection to containment
- Forensic preservation of logs and system states
- Timeline reconstruction of threat actor activity
HIPAA Security Rule § 164.312(b) - Audit Controls
Your logging infrastructure must capture sufficient detail to support forensic investigation:
- Authentication attempts (successful and failed)
- File access and modification timestamps
- Network traffic patterns and data transfer volumes
- Privileged account usage
Breach Notification Rule § 164.404-414
If your investigation confirms unauthorized acquisition of unsecured PHI, you're facing notification deadlines:
- Individual notification: within 60 days of breach discovery
- Media notification: if breach affects 500+ residents of a state
- HHS notification: within 60 days (500+ individuals) or annually (fewer than 500)
"Discovery" starts when you have a reasonable basis to believe a breach occurred, not when investigation concludes.
Implementation Guidance
Phase 1: Immediate Containment (Hours 0-24)
Activate your incident response plan the moment you detect unauthorized access. Nutex engaged an independent third-party cybersecurity response team and forensics experts immediately. You should:
- Isolate affected systems without destroying forensic evidence. Document every action with timestamps.
- Preserve memory and disk images before powering down compromised hosts.
- Block command-and-control traffic at your perimeter while maintaining logs of blocked attempts.
- Disable compromised credentials and force password resets for privileged accounts.
Don't assume the attack is over. RaaS groups often maintain persistence through multiple backdoors.
Phase 2: Forensic Investigation (Days 1-14)
Your forensic analysis must answer specific questions for HIPAA breach determination:
- What data was accessed? File paths, database tables, application logs.
- Was data exfiltrated? Network traffic analysis, unusual data transfer volumes.
- What's the attack timeline? Initial access, lateral movement, exfiltration periods.
- How many individuals affected? Patient records, employee files, provider credentials.
The Gentlemen and similar RaaS operations typically exfiltrate data before deploying encryption. Look for large outbound transfers to cloud storage services, file-sharing sites, or anonymized IP addresses days or weeks before ransomware deployment.
Phase 3: Breach Assessment (Days 7-30)
Under the Breach Notification Rule, you must determine whether exfiltrated data constitutes a breach of unsecured PHI. This requires:
- Inventory affected data types: patient demographics, clinical notes, employee health records, business associate information.
- Assess encryption status: Was the exfiltrated data encrypted and was the decryption key also compromised?
- Evaluate risk of harm: Consider the nature of PHI, who obtained it, whether it was actually acquired, and extent of mitigation.
If your investigation confirms that patient and employee information was exfiltrated (as Nutex disclosed on August 31, 2026), you're likely facing a reportable breach unless the data was encrypted to NIST SP 800-111 standards.
Phase 4: Regulatory Reporting (Days 30-60)
Coordinate your technical findings with legal and compliance teams for:
- SEC Form 8-K (Item 1.05): Material cybersecurity incident disclosure within four business days of materiality determination
- HIPAA breach notification: Individual letters, HHS reporting, potential media notice
- State breach notification laws: Many states have separate requirements and timelines
Common Pitfalls
Delaying forensic preservation: Rebooting systems or restoring from backup before imaging destroys evidence you need for breach assessment.
Assuming encryption prevents exfiltration: RaaS groups steal data in plaintext from live systems before deploying ransomware. Your at-rest encryption doesn't protect against this.
Treating all incidents as non-material initially: Nutex's August 24, 2026 filing stated the incident wasn't reasonably likely to have material impact. Seven days later, after investigation revealed the scope of exfiltration, they filed a material incident disclosure. Start your assessment assuming materiality until proven otherwise.
Inadequate logging retention: If you can't reconstruct the attack timeline because logs were overwritten or never captured, you can't accurately determine what data was accessed. Retain security logs for at least 90 days, preferably in immutable storage.
Underestimating investigation timelines: Nutex filed its initial disclosure on August 24, 2026, noting the incident was "still being assessed." Complex attacks require weeks to fully understand. Build realistic timelines into your incident response plan.
Quick Reference Table
| Phase | Timeline | Key Actions | HIPAA Requirement | Deliverable |
|---|---|---|---|---|
| Detection | Hours 0-4 | Monitor alerts, confirm unauthorized access | § 164.308(a)(6)(i) | Incident ticket, initial timeline |
| Containment | Hours 4-24 | Isolate systems, preserve evidence, block C2 | § 164.308(a)(6)(i) | Containment report, preserved images |
| Investigation | Days 1-14 | Forensic analysis, scope determination | § 164.312(b) | Forensic report, affected data inventory |
| Breach Assessment | Days 7-30 | Risk analysis, encryption review | Breach Notification Rule | Breach determination memo |
| Notification | Days 30-60 | Individual notice, HHS filing, media | § 164.404-414 | Notification letters, filing confirmations |
| Remediation | Days 30-90 | Patch vulnerabilities, enhance controls | § 164.308(a)(1)(ii)(B) | Corrective action plan |
Your incident response plan should map these phases to specific team members, decision points, and escalation criteria. When a RaaS group is actively exfiltrating your PHI, you don't have time to figure out who's responsible for forensic imaging or who authorizes taking production systems offline.
The Gentlemen isn't the last RaaS operation you'll face. Build these procedures now, test them quarterly, and ensure your logging infrastructure can support the forensic analysis you'll need when unauthorized access turns into data theft.
