Incident Response Guide: Malicious Browser Extensions in Ophthalmic Imaging PACS

How can a malicious browser extension affect ophthalmic imaging PACS?

A browser extension can create risk when an ophthalmic imaging PACS is accessed through a browser and the extension has permissions or access to that PACS site. Depending on its permissions and behavior, an extension may be able to read or alter page content, observe browsing activity, access cookies, or make network requests. These capabilities are documented in Chrome’s extension permissions guidance.

In a PACS workflow, that could expose patient identifiers, study details, images displayed in the viewer, or information entered into the application. An extension might also interfere with what a user sees in the browser or attempt to misuse a signed-in session. Those possibilities do not establish that PACS data was accessed, sent outside the organization, or changed in the archive. Determine the extension’s actual permissions, host access, code, and activity before drawing conclusions.

Assess patient-care impacts as well as confidentiality. If staff report unexpected image changes, missing studies, altered annotations, or disrupted access, have qualified imaging and clinical personnel validate the PACS records and viewer behavior. Treat browser display concerns separately from evidence that archived image data was modified.

What details should responders record when scoping an extension incident?

Start an incident record as soon as the extension is identified. Record the discovery time and time zone, reporting person, affected user and device, browser and profile, operating system, PACS application or URL, and the steps taken so far. Preserve relevant evidence before removing or changing the extension when it is safe to do so; NIST recommends collecting and retaining incident evidence in accordance with evidence-preservation procedures.

• Extension identity: Record its name, browser extension ID, version, publisher, installation source, update URL if available, and whether it was installed by a user or management policy.
• Access and behavior: Capture its requested permissions, host permissions, site-access settings, installation and update times, related files or hashes, and any suspicious domains, processes, or network connections.
• Scope indicators: Note the user’s PACS role, account, sessions, relevant dates, affected browser profiles, and any reported symptoms or patient-care workflow impacts.
• Actions and evidence handling: Keep a time-stamped record of decisions, containment steps, evidence sources, collectors, and transfers. Restrict access to incident records because they may contain sensitive information.

Permissions help define what to investigate, but they are not proof that data was accessed. For example, Chrome documents that host permissions can enable extension interactions such as accessing cookies, injecting scripts, or making requests to matching sites. Compare the permissions with observed behavior and logs rather than relying on the extension name or store listing alone.

How can teams assess potential exposure of PACS data?

Build a timeline that connects extension presence and activity to browser use, PACS access, user identity, and network events. Identify which endpoints and user profiles had the extension, whether the PACS site matched its host permissions, and which accounts accessed patient records during the relevant period. Include PACS access logs, browser or managed-browser telemetry, endpoint detection and response alerts, identity audit logs, and proxy, DNS, firewall, or secure web gateway records where available.

Determine what data could have been exposed: patient identifiers, study metadata, images, reports, or credentials and session tokens. Look for evidence of PACS queries or views, unusual account activity, unexpected outbound connections, suspicious downloads, and browser activity inconsistent with the user’s work. Check whether the extension or another process accessed local caches, screenshots, exports, or downloaded studies. Be explicit about logging gaps: an absence of a record is not conclusive if the relevant system did not capture or retain that event.

For HIPAA-regulated organizations, involve privacy, security, and legal personnel in determining whether an impermissible use or disclosure occurred and whether notification duties apply. HHS explains that an impermissible use or disclosure is generally presumed to be a breach unless the organization demonstrates a low probability that PHI was compromised through a risk assessment. That assessment considers the PHI involved, who received or used it, whether it was actually acquired or viewed, and mitigation. See the HHS Breach Notification Rule guidance.

Keep the breach determination distinct from the technical incident finding. A suspicious extension may justify investigation and containment without proving theft; conversely, incomplete logs may prevent responders from ruling out exposure. Document evidence, uncertainties, and the rationale for the organization’s decision.

How should organizations contain and remediate a compromised extension?

Coordinate incident response with PACS administrators, the security team, privacy personnel, clinical operations, and biomedical or clinical engineering staff as appropriate. Maintain a safe alternative imaging workflow before isolating a workstation that clinicians need. Follow the organization’s incident procedures: HHS says the HIPAA Security Rule requires organizations to identify and respond to suspected or known security incidents, mitigate harmful effects to the extent practicable, and document incidents and outcomes.

1. Preserve and contain: Capture relevant extension details and endpoint evidence when practicable, then isolate the affected workstation from networks if the risk warrants it. Avoid actions that could destroy needed evidence or interrupt patient care without a coordinated plan.
2. Disable and block: Use the organization’s browser-management controls to disable or block the identified extension and prevent reinstallation. Microsoft Edge’s enterprise policy guidance describes blocking specific extensions and controlling which extensions users can install.
3. Protect accounts: Revoke active sessions and tokens where possible, reset potentially exposed credentials, and review access or privilege changes. Base these steps on the suspected access path and evidence rather than assuming every user account was compromised.
4. Remove persistence and restore: Use endpoint detection and response to investigate for related malware, altered browser policies, or other persistence. Remove the extension and associated artifacts using approved procedures; rebuild or restore a workstation if its integrity cannot be established.
5. Verify recovery: Confirm that browser and PACS access are working as expected, validate relevant imaging workflows, and monitor for repeat installation or related indicators.

Retain a record of the investigation and remediation. NIST’s SP 800-61 Revision 3 provides current incident-response recommendations, including preserving incident data and recording response actions.

Which browser, identity, PACS, and network logs should responders review?

Collect records covering a consistent time window, preserve their original time zones, and account for clock differences between systems. Review the following sources where they exist and are enabled:

• Browser and managed-browser telemetry: Extension installation, removal, enablement, updates, policy changes, profile and site-access settings, browser sign-ins, downloads, and relevant browsing events. Capture the extension ID and version from each affected profile.
• Endpoint detection and response: Process execution, file writes, browser child processes, persistence mechanisms, security alerts, and connections attributed to the affected device. Correlate events with the extension’s installation and PACS-use timeline.
• Identity audit logs: Authentication events, multifactor prompts, new devices or locations, session creation and revocation, failed logins, privilege changes, and unusual account activity for affected users.
• PACS access logs: User sessions, patient or study searches, image views, exports, downloads, annotation or record changes, and administrator activity. Ask the PACS vendor or system owner what each event type records and what it omits.
• Network records: DNS, proxy, firewall, secure web gateway, VPN, and network detection logs for connections to unfamiliar domains, unexpected uploads, or other suspicious traffic from affected workstations.

HIPAA’s Security Rule includes requirements for reviewing information-system activity and for audit controls that record and examine activity in systems containing or using ePHI. See the HHS guidance on security incident procedures and HHS’s Security Rule audit protocol.

How can imaging workstations and interconnected equipment be protected after an incident?

Inventory affected diagnostic workstations, browser profiles, PACS components, and connected imaging equipment. Check other managed devices for the same extension ID, version, installation source, or related indicators, then investigate matching devices using the same evidence-led process. Broader scoping is important because an extension or associated compromise may affect more than the first reported workstation.

Reduce recurrence by using application allowlisting and centrally managed browser policies to restrict extensions to approved, necessary software. Review permissions and PACS-site access before approving an extension, and periodically compare installed extensions against the approved inventory. Apply least privilege to workstation and PACS accounts, and monitor browser policy changes and extension installations.

Protect the wider imaging environment with network segmentation and tightly controlled communications between diagnostic workstations, PACS systems, and connected equipment. CISA’s healthcare-sector mitigation guide recommends network segmentation, access controls, and analysis of traffic logs. Coordinate changes to medical devices, PACS integrations, or vendor-supported configurations with clinical engineering and the relevant vendors to avoid disrupting validated workflows.

Strong diagnostic workstation security combines extension controls, timely investigation, restricted access, preserved logs, and tested recovery plans. After containment, use the incident findings to improve policies and monitoring, update relevant security risk assessments, and confirm that imaging services remain safe and available for patient care.

FAQs.

Does a suspicious browser extension prove that PACS data was stolen?

No. A suspicious extension is an indicator to investigate, not proof that PACS data was accessed or stolen. Assess its permissions and site access alongside PACS, identity, endpoint, and network evidence. If records are incomplete, document that uncertainty and have privacy and legal personnel assess any breach-notification obligations.

What information should be recorded about an affected extension?

Record the extension name, browser extension ID, version, publisher, source, update URL if available, requested permissions, host access, affected browser profile and device, installation and update times, related hashes or indicators, and the user’s relevant PACS activity. Preserve evidence and maintain a time-stamped record of response actions.

Should responders check other managed devices for the same extension?

Yes. Search managed-browser telemetry and endpoint records for the same extension ID, version, source, or related indicators across other managed devices. Investigate matches and expand the search if evidence suggests additional accounts, devices, or PACS systems were involved.

How can diagnostic workstations be protected from unauthorized software?

Use centrally managed browser controls, application allowlisting, least-privilege accounts, endpoint detection and response, and monitoring for unauthorized software or policy changes. Restrict network paths to those required for imaging workflows, and coordinate device or PACS configuration changes with clinical engineering and vendors.