Universal Dermatology Data Breach Affects 35,295 Patients – Claim Depot
HHS Declares Public Health Emergencies for Florida, Alabama following Hurricane Isaias – HHS.gov
FDA Launches the Rare Disease Framework Initiative to Develop a Holistic, Fit-For-Purpose Framework for Rare Disease Drug Development – HHS.gov
Ivanti Connect Secure Zero Day Exploited in Attacks – The HIPAA Journal
Ivanti Connect Secure Zero Day Exploited in Attacks The HIPAA Journal
Trump Administration Delivers Second Year of Savings by Stopping Taxpayer Payments for Duplicate and Deceased Enrollees in Obamacare – HHS.gov
Ivanti Connect Secure Zero Day Exploited in Attacks
A high-severity authentication bypass vulnerability has been identified in the Ivanti Connect Secure (Pulse Connect Secure) enterprise-grade SSL VPN that can allow a remote, unauthenticated malicious actor to execute arbitrary commands, steal credentials, and exfiltrate sensitive data.
Researchers at the cybersecurity firm Volexity identified in-the-wild exploitation of a vulnerability chain involving the authentication bypass vulnerability in the first week of October. The threat actor was able to compromise a fully patched ICS VPN appliance and achieve remote, root-level code execution. The vulnerability has been exploited by malicious actors on limited ICS customers and has been added to CISA’s Known Exploited Vulnerability (KEV) Catalog.
Volexity determined that the threat actor exploited three zero-day vulnerabilities in the attack, including the authentication bypass vulnerability and a remote code execution vulnerability, which are jointly tracked as CVE-2026-104935. The vulnerability has a CVSS v3.1 base score of 8.6. Ivanti says the vulnerability has been exploited by malicious actors onlimited ICS customers, and has been added to CISA’s Known Exploited Vulnerability (KEV) Catalog. The third zero-day is a privilege escalation vulnerability, which has yet to be patched. Ivanti is working on a patch to fix that flaw, which will be addressed in a future release.
The CVE-2026-104935 vulnerability affects the following Ivanti Connect Secure (ICS) versions, and patches have been released to fix the flaws. Customers are also advised to run the Integrity Checker Tool regularly.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
| Affected Versions | Fixed versions |
| 25.1.1.1 and prior | 25.1.1.2 |
| 25.1.2.2 and prior | 25.1.3.0, 25.1.3.1 |
| 22.8R2.4 and prior | 22.8R2.5 |
Limited indicators of compromise have been identified by Volexity and are detailed in its blog post.
The post Ivanti Connect Secure Zero Day Exploited in Attacks appeared first on The HIPAA Journal.
Twin Cities Pain Clinic Settles Data Breach Litigation
Twin Cities Pain Clinic, an Edina, Minnesota-based pain management center, has settled class action litigation arising from a July 2025 data incident that exposed patients’ personal and protected health information. A cybercriminal gained access to an employee’s email account in a business email compromise attack, exposing patient information such as names, dates of birth, addresses, email addresses, phone numbers, financial account information, medical record numbers, treatment notes, provider information, health insurance information, and Social Security numbers. The data breach was reported to the HHS’ Office for Civil Rights as affecting 3,572 patients.
Multiple class action lawsuits were filed in response to the data breach, alleging the defendant was at fault. The lawsuits were consolidated into a single action – In re Twin Cities Pain Clinic Data Breach Litigation – in the District Court of Hennepin County, Minnesota. The consolidated lawsuit asserted claims for negligence, negligence per se, breach of contract, breach of implied contract, unjust enrichment, breach of fiduciary duty, breach of confidence, and violations of the Minnesota Uniform Deceptive Trade Practice Act and Minnesota Health Records Act.
Twin Cities Pain Clinic maintains there was no wrongdoing and disagrees with the claims and contentions in the lawsuit; however, a settlement has been agreed upon that is acceptable to all parties to avoid the cost, distraction, burden, risks, and disruption to business operations from protracted litigation. Twin Cities Pain Clinic has agreed to pay attorneys’ fees and expenses, settlement administration costs, service awards to the class representatives, and cash payments to the class members. The cash payments are subject to a $385,000 cap and will be paid pro rata if that total is exceeded.
Class members may choose to submit a claim for reimbursement of documented, unreimbursed losses incurred between July 9, 2025, and November 9, 2026, up to a maximum of $450 for ordinary losses, and up to $4,500 for extraordinary losses. Alternatively, a claim may be submitted for a flat cash payment, estimated to be $55 per class member. The deadline for objection, opting out, and submitting a claim is November 9, 2026. The final fairness hearing has been scheduled for January 20, 2027.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The post Twin Cities Pain Clinic Settles Data Breach Litigation appeared first on The HIPAA Journal.