CISA Flags Active Exploitation of Cleo and SimpleHelp Used in Healthcare PHI Transfers

Active exploitation forces faster patch cycles and vendor scrutiny

CISA and the American Hospital Association issued joint alerts in late May flagging active exploitation of critical vulnerabilities in Clio file-transfer software and SimpleHelp remote monitoring tools used across healthcare organizations for PHI movement and clinical system access. The Cleo vulnerability allowed file transfers without restriction before patching. A separate CISA alert covered high-severity flaws in Hillrom Welch Allyn cardiology devices used for diagnostic data capture.

These are not theoretical risks. The AHA and Health-ISAC joint alert on SimpleHelp, combined with CISA's direct involvement, signals vulnerabilities scoring at least 7.0 on the CVSS scale — the threshold where patch timelines become enforceable compliance questions under HIPAA's Security Rule.

For healthcare CISOs, the alerts mean vendor risk management just moved from annual attestation review to active technology replacement decisions. Organizations relying on lower-cost or lightly governed remote-access and file-transfer tools now face budget pressure to upgrade to enterprise SKUs with enforced least-privilege access, centralized logging, and contractual patch SLAs.

Breach volume dropped but affected individuals jumped 58 percent

The number of large healthcare breaches reported in 2024 declined 0.5 percent compared to 2023, but the number of individuals affected increased 58 percent over the same period. That pattern — fewer incidents, vastly larger exposure per incident — tells buyers that attackers are successfully targeting centralized infrastructure rather than isolated endpoints.

Healthcare breached records reached 133 million in 2023, a 156 percent increase year-over-year. The first half of 2024 alone logged 387 breaches affecting 500 or more records, affecting more than 100 million people. These figures are now appearing in OCR guidance and board-level risk discussions as the baseline for what constitutes "reasonable" cybersecurity in the sector.

The shift from many small breaches to fewer catastrophic ones changes budget allocation. Perimeter defenses and endpoint tools remain necessary but insufficient. Buyers are being pushed toward continuous monitoring platforms, real-time configuration auditing, and third-party risk scoring that can flag the kind of centralized infrastructure vulnerabilities — file-transfer gateways, RMM platforms, cloud IAM misconfigurations — that produce eight-figure victim counts.

RFP language will require defined patch timelines and secure-by-default configuration

The Cleo and SimpleHelp alerts create immediate procurement friction. Buyers can no longer treat managed file transfer or remote monitoring as "boring plumbing." Both categories are now top-tier attack surfaces, and OCR post-breach investigations increasingly scrutinize whether known, CISA-flagged vulnerabilities remained unpatched as evidence of HIPAA Security Rule failure.

Expect RFP requirements to shift toward:

- Contractual patch timelines for critical vulnerabilities, typically 7 to 15 days, spelled out in Business Associate Agreements and Master Service Agreements. - Evidence of secure-by-default configuration, with ability to centrally enforce least privilege, logging, and network segmentation. - Formal third-party risk documentation including recent penetration test summaries, SOC 2 Type II reports, ISO 27001 certification, and FDA Software Bill of Materials for connected devices.

In the RMM market, SimpleHelp competes with ConnectWise ScreenConnect, NinjaOne, Kaseya VSA, and TeamViewer Tensor. In file transfer, Cleo competes with Progress MOVEit, Axway, IBM Sterling, and GoAnywhere. Progress MOVEit's 2023 breach wave and now Cleo's critical-vulnerability exploitation establish a pattern: healthcare organizations that selected these tools based on cost or legacy integration are now revisiting vendor lock-in at the worst possible time.

For medical devices, CISA's alert on Hillrom Welch Allyn cardiology products accelerates end-of-support debates. Buyers will favor vendors that commit to timely security patches across the device lifecycle and provide clear vulnerability communication as part of standard service contracts, not as premium add-ons.

What to watch: compliance platforms position against "check-the-box" HIPAA programs

Continuous compliance and monitoring vendors — Drata, Vanta, Arctic Wolf MDR, Clearwater, CynergisTek — are using the breach statistics and federal alerts to argue that annual risk assessments and static policy documentation no longer meet the "reasonable and appropriate" standard under HIPAA. Buyers should evaluate whether these platforms can automate evidence collection for the new RFP requirements above, particularly around third-party patch status and configuration drift.

Cloud infrastructure and EHR vendors will face renewed shared-responsibility negotiations. Hospitals and payers are using the 58 percent increase in affected individuals to push AWS, Azure, Google Cloud, Epic, and Oracle Health to accept more explicit contractual accountability for configuration baselines, access logging, and breach notification timelines.

The compliance bar just moved. Organizations treating cybersecurity as an IT function rather than an enterprise risk program will find themselves explaining to regulators and plaintiffs' attorneys why they didn't act on federal alerts that named the specific products they deployed.