A Minnesota pain management clinic has agreed to pay up to $385,000 to settle class-action claims stemming from a 2025 email breach. Twin Cities Pain Clinic in Edina reported to federal regulators that the July 2025 business email compromise incident exposed records for 3,572 patients.
A cybercriminal gained access to an employee’s email account in the July attack. The compromised account held names, birth dates, addresses, phone numbers, financial account numbers, medical record numbers, clinical notes, provider identities, insurance details, and Social Security numbers.
Affected patients may file claims for documented out-of-pocket losses that occurred between July 9, 2025 and November 9, 2026. Ordinary losses cap at $450 per claimant; extraordinary losses reach $4,500. Alternatively, class members may accept a flat $55 payment. The deadline for claims, objections, and opt-outs falls on November 9, 2026. The court will hold a fairness hearing on January 20, 2027. Twin Cities Pain Clinic denies any wrongdoing.
For smaller healthcare providers, the case highlights a persistent threat: one compromised email inbox can expose an entire patient roster’s protected health information. Business email compromise attacks continue to rank among the most frequent pathways adversaries use to reach medical records at practices without enterprise-grade detection systems.
Clinics in this size bracket should deploy phishing-resistant multi-factor authentication on all email accounts, limit record access to staff who need it, and classify mailbox intrusions as immediately reportable incidents rather than waiting for forensic investigations to conclude.
