Ivanti Connect Secure Zero Day Exploited in Attacks

Posted by Steve Alder

A high-severity authentication bypass vulnerability has been identified in the Ivanti Connect Secure (Pulse Connect Secure) enterprise-grade SSL VPN that can allow a remote, unauthenticated malicious actor to execute arbitrary commands, steal credentials, and exfiltrate sensitive data.

Researchers at the cybersecurity firm Volexity identified in-the-wild exploitation of a vulnerability chain involving the authentication bypass vulnerability in the first week of October. The threat actor was able to compromise a fully patched ICS VPN appliance and achieve remote, root-level code execution. The vulnerability has been exploited by malicious actors on limited ICS customers and has been added to CISA’s Known Exploited Vulnerability (KEV) Catalog.

Volexity determined that the threat actor exploited three zero-day vulnerabilities in the attack, including the authentication bypass vulnerability and a remote code execution vulnerability, which are jointly tracked as CVE-2026-104935. The vulnerability has a CVSS v3.1 base score of 8.6. Ivanti says the vulnerability has been exploited by malicious actors onlimited ICS customers, and has been added to CISA’s Known Exploited Vulnerability (KEV) Catalog. The third zero-day is a privilege escalation vulnerability, which has yet to be patched. Ivanti is working on a patch to fix that flaw, which will be addressed in a future release.

The CVE-2026-104935 vulnerability affects the following Ivanti Connect Secure (ICS) versions, and patches have been released to fix the flaws. Customers are also advised to run the Integrity Checker Tool regularly.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Affected Versions Fixed versions
25.1.1.1 and prior 25.1.1.2
25.1.2.2 and prior 25.1.3.0, 25.1.3.1
22.8R2.4 and prior 22.8R2.5

Limited indicators of compromise have been identified by Volexity and are detailed in its blog post.

The post Ivanti Connect Secure Zero Day Exploited in Attacks appeared first on The HIPAA Journal.

Twin Cities Pain Clinic Settles Data Breach Litigation

Posted by Steve Alder

Twin Cities Pain Clinic, an Edina, Minnesota-based pain management center, has settled class action litigation arising from a July 2025 data incident that exposed patients’ personal and protected health information. A cybercriminal gained access to an employee’s email account in a business email compromise attack, exposing patient information such as names, dates of birth, addresses, email addresses, phone numbers, financial account information, medical record numbers, treatment notes, provider information, health insurance information, and Social Security numbers. The data breach was reported to the HHS’ Office for Civil Rights as affecting 3,572 patients.

Multiple class action lawsuits were filed in response to the data breach, alleging the defendant was at fault. The lawsuits were consolidated into a single action – In re Twin Cities Pain Clinic Data Breach Litigation – in the District Court of Hennepin County, Minnesota. The consolidated lawsuit asserted claims for negligence, negligence per se, breach of contract, breach of implied contract, unjust enrichment, breach of fiduciary duty, breach of confidence, and violations of the Minnesota Uniform Deceptive Trade Practice Act and Minnesota Health Records Act.

Twin Cities Pain Clinic maintains there was no wrongdoing and disagrees with the claims and contentions in the lawsuit; however, a settlement has been agreed upon that is acceptable to all parties to avoid the cost, distraction, burden, risks, and disruption to business operations from protracted litigation. Twin Cities Pain Clinic has agreed to pay attorneys’ fees and expenses, settlement administration costs, service awards to the class representatives, and cash payments to the class members.  The cash payments are subject to a $385,000 cap and will be paid pro rata if that total is exceeded.

Class members may choose to submit a claim for reimbursement of documented, unreimbursed losses incurred between July 9, 2025, and November 9, 2026, up to a maximum of $450 for ordinary losses, and up to $4,500 for extraordinary losses. Alternatively, a claim may be submitted for a flat cash payment, estimated to be $55 per class member. The deadline for objection, opting out, and submitting a claim is November 9, 2026. The final fairness hearing has been scheduled for January 20, 2027.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The post Twin Cities Pain Clinic Settles Data Breach Litigation appeared first on The HIPAA Journal.

Photon Health; Healthcare Highways Announce Data Security Incidents

Posted by Steve Alder

Data breaches have been announced by the New York-based healthcare technology company Photon Health, the Texas-based medical provider network company Healthcare Highways, and the New York-based home health agency Any-Time Home Care.

Photon Health

Photon Health, a Brooklyn, New York-based healthcare technology company that operates a prescription network, has disclosed a cybersecurity incident involving unauthorized access to patient data. Photon Health learned on August 21, 2026, that a previously unknown security flaw in a self-hosted third-party application called Metabase had been exploited.

Metabase was used by Photon Health for business intelligence, product metrics, and customer dashboards. The threat actor exploited the zero-day vulnerability and gained access to stored data, which was potentially exfiltrated. Photon Health completed its data review on September 4, 2026, when it was confirmed that data compromised in the incident included names, addresses, phone numbers, birth dates, and prescription information. Notification letters started to be mailed to the affected individuals on October 8, 2026. At the time of issuing notification letters, Photon Health was unaware of any misuse of the impacted data. The Direwolf ransomware and data extortion group claimed responsibility for the attack.

The company has not yet publicly disclosed how many of its clients have been affected or the total number of individuals who had their data exposed in the incident, but has confirmed that complimentary credit monitoring and identity theft protection services have been offered to the affected individuals. Photon Health also confirmed that it is reviewing its cybersecurity measures and is taking steps to prevent similar incidents in the future.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Healthcare Highways

Healthcare Highways, a Frisco, Texas-based medical provider network company and health plan administrator, has recently disclosed a cybersecurity incident that was first identified on August 4, 2026. An investigation was launched to determine the nature and scope of the activity, which confirmed that an unauthorized third party had access to its network between July 22, 2026, and July 27, 2026. During that time, the protected health information of certain individuals was accessed and acquired.

The review of the affected data is ongoing; however, it has been determined that the types of data compromised in the incident include names, addresses, dates of birth, dates of service, Social Security numbers, patient ID numbers, procedure codes and costs, procedure/provider information, diagnoses, claims information, health insurance information, and information related to payment for healthcare services.

Healthcare Highways has yet to publicly disclose the total number of individuals affected by the incident. While the group behind the attack was not disclosed, the Chaos ransomware group claimed responsibility and says it exfiltrated 235 GB of data.

Any-Time Home Care

The New York-based home health agency Any-Time Home Care has recently disclosed a ransomware attack that was identified in March 2026. The forensic investigation determined that an unauthorized third party first accessed its network on or around March 17, 2026, and encrypted files. Files on the compromised parts of its network have been reviewed and found to contain names, addresses, birth dates, health information, and Social Security numbers. In total, 30,017 individuals have been affected by the incident. The affected individuals have been offered 24 months of complimentary credit monitoring and identity theft protection services.

The post Photon Health; Healthcare Highways Announce Data Security Incidents appeared first on The HIPAA Journal.

Roseland Community Hospital Association Settles Data Breach Lawsuit for $650,000

Posted by Steve Alder

Roseland Community Hospital Association in Illinois has agreed to settle a class action data breach lawsuit for $650,000. The lawsuit was filed in response to a 2024 cybersecurity incident that exposed sensitive patient and employee information. The attack was detected on June 2, 2024, and the investigation determined that names, dates of birth, addresses, medical record numbers, patient account numbers, health insurance information, diagnoses, and treatment information were present in the exposed data.

The data breach was reported to the HHS’ Office for Civil Rights using an estimate of at least 500 affected individuals, as required by the HIPAA Breach Notification Rule; however, that total has not been updated since the initial report, even though the data breach was far more extensive. According to court documents, the personal and protected health information of 101,354 individuals was potentially compromised in the incident. The affected individuals started to be notified on August 1, 2024.

On November 25, 2024, a class action lawsuit was filed by plaintiff Steven Hall in the Circuit Court of Cook County, Illinois, individually and on behalf of his three minor children. The lawsuit was consolidated with two further complaints as they had overlapping claims and classes. The plaintiffs alleged that the defendant was at fault, as reasonable cybersecurity measures had not been implemented as required by HIPAA, including but not limited to data encryption and logging, monitoring, and alerting tools. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, breach of bailment, invasion of privacy/disclosure of private information, and violation of the Illinois Consumer Fraud and Deceptive Business Practices Act.

The defendant maintains there was no wrongdoing and filed a motion to dismiss, which was granted in part and denied in part. The consolidated lawsuit – Hall, et al. v. Roseland Community Hospital Association – is pending in the Circuit Court of Cook County, Illinois. The parties engaged in settlement discussions and negotiated a settlement to avoid the costs and risks associated with protracted litigation. The settlement has recently received preliminary approval from the court.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Under the terms of the settlement, Roseland Community Hospital Association has agreed to pay $650,000 to settle the lawsuit, inclusive of attorneys’ fees and expenses, settlement administration and notice costs, service awards for the class representatives, and benefits for the class members. Class members may claim one year of medical data monitoring services, reimbursement of documented losses due to the data breach up to a maximum of $5,000 per class member, and a pro rata cash payment, estimated to be $50 per class member. The cash payments are subject to a pro rata adjustment based on the number of claims received.

The deadline for objection and opting out is December 1, 2026. Claims must be submitted by December 31, 2026, and the final fairness hearing has been scheduled for January 6, 2027.

The post Roseland Community Hospital Association Settles Data Breach Lawsuit for $650,000 appeared first on The HIPAA Journal.