Royal Medical Center Contains a Live AWS Security Incident in Under 4 Hours and Reduces Cloud Costs by 35% with OneData
Learn how Royal Medical Center strengthened its AWS security posture, contained a live security incident in under four hours, improved its PCI DSS compliance posture, and reduced overall cloud costs by 35% with OneData.
Benefits
Under 4 Hours
Security incident containment
100%
Security monitoring coverage
PCI DSS
Improved compliance posture
$250K–$500K
Potential compliance penalties avoided
35%
Reduction in overall cloud costs
$3,700+
Monthly cost savings achieved
About Royal Medical Center
Royal Medical Center (RMC) is a healthcare provider focused on personalized wellness and treatment programs designed to improve patient outcomes and quality of life. By combining healthcare expertise with digital platforms, RMC supports patient engagement, streamlines operations, and enhances service delivery.
Overview
As Royal Medical Center expanded its digital healthcare services, protecting sensitive patient data and maintaining reliable infrastructure became increasingly important. However, its AWS environment faced a live security incident, gaps in security monitoring, vulnerabilities across infrastructure, and rising cloud costs.
RMC needed to address the immediate security threat while strengthening its long-term security and compliance posture. At the same time, it wanted to improve infrastructure efficiency and gain better visibility into cloud spending.
To address these challenges, RMC partnered with OneData to contain the incident, remediate security vulnerabilities, establish comprehensive monitoring, and optimize its AWS environment. Using AWS-native security and cost management services, OneData helped RMC improve operational visibility, strengthen governance, and build a more secure and cost-efficient cloud foundation.
Overview
As Royal Medical Center expanded its digital healthcare services, protecting sensitive patient data and maintaining reliable infrastructure became increasingly important. However, its AWS environment faced a live security incident, gaps in security monitoring, vulnerabilities across infrastructure, and rising cloud costs.
RMC needed to address the immediate security threat while strengthening its long-term security and compliance posture. At the same time, it wanted to improve infrastructure efficiency and gain better visibility into cloud spending.
To address these challenges, RMC partnered with OneData to contain the incident, remediate security vulnerabilities, establish comprehensive monitoring, and optimize its AWS environment. Using AWS-native security and cost management services, OneData helped RMC improve operational visibility, strengthen governance, and build a more secure and cost-efficient cloud foundation.
Challenge | Responding to a Security Incident While Managing Cloud Risk
RMC faced a combination of immediate security concerns and ongoing infrastructure challenges that affected its security posture, compliance readiness, and operational efficiency.
Security vulnerabilities and exposure
Misconfigured Amazon S3 buckets created potential data exposure risks, while missing multi-factor authentication (MFA) enforcement and long-lived credentials increased the risk of unauthorized access. Publicly exposed services expanded the attack surface, and hard-coded application secrets introduced additional vulnerabilities.
Unpatched Windows servers and gaps in logging across AWS regions further limited visibility into system activity, making it more difficult to detect suspicious behavior and investigate potential threats.
Compliance and operational risks
These security gaps affected RMC’s PCI DSS compliance posture and increased the risk of penalties and operational disruption. The organization needed to strengthen security controls, improve audit visibility, and preserve evidence for incident investigation and compliance review.
Rising cloud costs
Alongside its security concerns, RMC was managing underutilized infrastructure, unused services, and limited cost visibility. These inefficiencies contributed to increasing cloud expenditure and highlighted the need for a structured cost optimization strategy.
RMC needed a comprehensive approach to contain the incident, investigate its root cause, remediate vulnerabilities, strengthen continuous monitoring, and reduce unnecessary cloud spending.
Solution | Strengthening AWS Security and Optimizing Cloud Operations
OneData implemented a structured transformation of RMC’s AWS environment, addressing incident response, security hardening, compliance alignment, continuous monitoring, and cost optimization.
Preparation | Establishing Security Visibility
OneData established the foundation for incident detection and response by enabling AWS-native security services, including Amazon GuardDuty, AWS Security Hub, AWS Config, and Amazon Inspector.
AWS CloudTrail was configured with log file validation and multi-region coverage to improve audit visibility and support forensic investigations. Centralized logging and extended log retention helped strengthen security monitoring and compliance review capabilities.
Detection and Analysis | Identifying Suspicious Activity
Amazon GuardDuty detected anomalous IAM credential activity involving an SES SMTP access key used from an unrecognized external IP address. The activity coincided with an unusual spike in outbound email volume.
OneData investigated the alert, identified the affected resources, and assessed the scope of the incident. Amazon GuardDuty, AWS Security Hub, AWS Config, CloudTrail Lake, VPC Flow Logs, and application load balancer logs supported the investigation.
Amazon Detective helped correlate activity and investigate suspicious IAM behavior, API events, and related operational activity, providing additional context for root cause analysis.
Containment | Acting Within Four Hours
OneData initiated containment measures to stop the unauthorized activity and limit further exposure. The compromised SES SMTP credential was revoked, and exposed services such as FTP and Redis were secured.
Forensic evidence was preserved using AWS CloudTrail with log validation and Amazon S3 Object Lock to support the investigation and PCI review.
The incident was contained within four hours of identification, with zero downtime to healthcare operations.
Eradication | Addressing Root Causes and Vulnerabilities
The investigation traced the incident to a publicly accessible configuration file containing SES SMTP credentials. OneData removed the file from the web root, eliminated the exposed credential, and hardened the web server to restrict access to sensitive files and paths.
Security remediation included applying Windows security patches, upgrading infrastructure where necessary, strengthening endpoint protection, and hardening applications.
IAM policies were restructured to enforce MFA, rotate credentials, eliminate hard-coded secrets, and remove unnecessary long-lived access keys. Network protections were strengthened by restricting RDP access through IP allowlists, VPN, and MFA.
Sensitive data stored in Amazon RDS was encrypted using AWS Key Management Service (KMS), while network firewall policies helped control outbound traffic and reduce unnecessary exposure.
Recovery and Continuous Monitoring | Improving Operational Visibility
Following containment and remediation, outbound email activity returned to its normal baseline, as verified through Amazon CloudWatch metrics.
OneData established a monitoring framework using Amazon GuardDuty, AWS Config, Amazon Inspector, and AWS Security Hub to improve threat detection, vulnerability assessment, and security visibility across the environment.
Logging was expanded and centralized to strengthen monitoring across AWS regions. Amazon OpenSearch Service Serverless was integrated into OneData’s centralized managed security service provider (MSSP) environment to support security analytics, log correlation, operational dashboards, and incident investigation workflows.
These capabilities improved visibility into security findings and supported more coordinated investigation and response activities.
Post-Incident Activity | Strengthening Future Readiness
OneData aligned incident response operations with AWS security incident response best practices, incorporating investigation workflows, evidence preservation, escalation procedures, remediation tracking, and post-incident reviews.
The review examined the incident timeline, root cause, contributing factors, and detection gaps. Preventive actions included tighter credential management, restricted remote access, and hardened exposed services. These actions were tracked to completion and incorporated into the ongoing monitoring framework.
Cost Optimization | Reducing Cloud Expenditure
Alongside security improvements, OneData optimized RMC’s AWS environment by removing unused resources, rightsizing workloads, and aligning service configurations with actual demand.
Cost allocation tagging, AWS Cost Explorer, and Amazon CloudWatch improved financial visibility and helped identify further optimization opportunities.
Changes were implemented in a controlled, phased manner to maintain uninterrupted healthcare operations.
Outcome | Measurable Security and Cost Improvements
Through its collaboration with OneData, Royal Medical Center strengthened its AWS security posture, improved operational visibility, and reduced cloud expenditure while maintaining continuity of healthcare operations.
Incident Response and Security
Under 4 Hours — Incident Containment
The live security incident was contained within four hours of identification, limiting further unauthorized activity.
ZeroZero — Public S3 Exposure After Remediation
Remediation addressed the identified public S3 exposure.
100% — Security Monitoring Coverage
Amazon GuardDuty, AWS Config, AWS Security Hub, and Amazon Inspector supported comprehensive security monitoring across the environment.
Zero — Critical Ports Left Unsecured
Critical ports were secured, and scan attempts were reduced to zero.
PCI DSS — Improved Compliance Posture
Security controls, audit visibility, and incident response processes were strengthened to support PCI DSS compliance alignment.
$250K–$500K — Potential Compliance Penalties Avoided
The project reported potential compliance penalties avoided within this estimated range.
Cost & Operational Impact
35% — Reduction in Overall Cloud Costs
Infrastructure optimization reduced overall cloud expenditure.
$3,700+ — Monthly Savings Achieved
Ongoing cost savings were achieved through improved resource utilization and cloud cost management.
30–40% — Savings Compared with Third-Party Security Tools
The reported savings reflected the cost advantage of the AWS-native security approach compared with third-party security tools.
25% — Reduction in Operational Overhead
Improved monitoring and centralized investigation workflows helped reduce operational overhead.
By combining AWS-native security services, structured incident response, and cost optimization, OneData helped Royal Medical Center move toward a more secure, visible, and cost-efficient cloud environment. With stronger security controls and improved operational governance in place, RMC is better positioned to protect sensitive patient data, support compliance requirements, and scale its digital healthcare services with confidence.
Build a more secure and cost-efficient
AWS environment
Partner with OneData to optimize your cloud infrastructure, reduce costs, and
strengthen security—without compromising performance.
