A published analysis by Marco A. De Felice on SuspectFile argues that the dominant frame for discussing cybersecurity incidents — identifying and attributing threat actors — systematically draws attention away from the organizational choices that make those incidents so damaging. The argument lands with particular weight for healthcare, where centralized records, long retention schedules, and regulatory mandates to share data create conditions that attackers reliably exploit.
The structural problem
De Felice's central claim is that organizations treat breaches as events caused entirely by outside actors, when the scale of harm in most incidents is better explained by internal decisions made long before any attack occurred. Those decisions include collecting data that may not be strictly necessary, centralizing it in ways that reduce friction for authorized users but also for attackers, and retaining it well past the point of operational need.
In healthcare, those patterns are not accidental. Billing requirements, quality-reporting mandates, population-health analytics, and litigation hold policies all create legitimate pressure to accumulate records. The result is that a single compromised credential or unpatched edge device can expose years of patient history rather than a narrow slice of current data.
Where attribution thinking falls short
Attributing a breach to a named ransomware group or nation-state actor satisfies a narrative demand and can support law-enforcement referrals, but it does not change the data inventory that was exposed. If the same volume of records sits in the same configuration after the incident, the next actor — more opportunistic and less sophisticated — faces an identical target.
The analysis also challenges the implicit assumption that better threat intelligence alone reduces breach impact. Knowing an adversary's tactics matters for detection and containment, but practices that have not addressed data minimization or segmentation remain exposed regardless of how accurately they can name the group responsible.
What this signals for compliance operations
The argument maps onto existing regulatory obligations that many covered entities treat as checkbox exercises rather than ongoing discipline. The HIPAA Security Rule's requirements for access controls, minimum necessary use, and periodic risk analysis are, at their core, tools for reducing what is available to an attacker — not just for satisfying an audit.
Practices that have deferred data-lifecycle reviews, allowed role-based access controls to drift as staff turned over, or consolidated records into large flat databases for reporting convenience have effectively increased their exposure independent of any specific threat. De Felice's framing suggests those decisions deserve the same analytical attention that security teams currently give to adversary techniques.
What independent practices should check
The commentary does not prescribe specific remedies, but the structural critique points to a short list of questions that compliance officers and practice administrators can apply directly:
- Data inventory currency. When was the last time the practice confirmed what categories of patient data it holds, where that data lives, and how long it is retained under current policy?
- Retention schedule alignment. Do retention periods reflect actual legal minimums, or have they grown by default because no one reviewed them after a system migration?
- Centralization decisions. Were records consolidated into shared repositories for convenience, and if so, does access control granularity reflect the sensitivity of what is now aggregated?
- Post-incident configuration review. After any security event, did the practice change the data configuration that shaped the event's scope, or only the technical control that was bypassed?
The piece does not argue that threat actor attribution is worthless — it argues that attribution without structural reform produces the same breach twice.