Case Study: DAVITOO UKRAINE – LMS Security Testing Before HIPAA Certification

Client:

DAVITOO UKRAINE LLC — a developer of e-learning and analytics software

Industry:

Healthcare

Focus:

Ensuring the security of the LMS Collaborator platform for HIPAA compliance

Main challenge:

Identifying critical vulnerabilities in web applications and server infrastructure to prevent leaks of medical and personal data

Market:

International

Services provided:

Gray-box penetration testing and security audit of the web platform, containerized environments, and network interactions

Key Takeaways

Completed a full security audit and gray-box penetration test of LMS Collaborator

Identified 15 vulnerabilities, including 5 critical issues, resolved within 24 hours

Delivered a detailed report with recommendations for ongoing security improvements

Increased the platform’s resilience to cyberattacks by 95%

Achieved full compliance with HIPAA requirements

vulnerabilities identified

95%

increase in attack resilience

100%

compliance with HIPAA requirements

Case Study: DAVITOO UKRAINE – LMS Security Testing Before HIPAA Certification

Apr 11, 2025

14 min

DAVINTOO UKRAINE LLC was preparing for HIPAA certification and requested a security testing of its LMS platform, which handles sensitive data. Datami performed a full security audit and gray-box penetration test. As a result, after addressing the identified vulnerabilities, LMS Collaborator now fully meets security requirements.

DAVINTOO UKRAINE LLC is an international IT company specializing in software solutions for the e-learning sector. Its flagship product, LMS Collaborator, is a web-based platform for learning, communication, and analytics, used daily by over 5,000 users.

Given that DAVINTOO handles both personal and medical data, HIPAA compliance is critical to ensuring the security of its digital products.

Objectives and challenges

DAVINTOO UKRAINE LLC initiated a comprehensive security testing of its LMS Collaborator platform as part of its preparation for HIPAA certification. The primary challenge lay in identifying potential vulnerabilities within the web platform, its applications, and the underlying server infrastructure.

The project aimed to ensure compliance with international security standards and to reduce the risk of data breaches.

Conduct a penetration test and security audit of the web platform, servers, and web applications.
Deliver a comprehensive report with recommendations following HIPAA standards.
Complete the assessment with maximum accuracy within the defined 4-week timeline.

Pentest and security audit

Gray-box testing of LMS, servers and web applications for vulnerabilities

Vulnerability detection

Threat detection, security enhancement, and risk minimization

Report preparation

Report preparation with recommendations for HIPAA certification

Datami Methodology: Security Testing for DAVINTOO UKRAINE LLC

Our approach

Datami conducted a comprehensive security audit of the internal infrastructure of DAVINTOO UKRAINE LLC, covering the web platform, servers, and applications.

Regular communication with the client — including weekly status meetings and interim reports — ensured effective task management and rapid incident response.

To assess risks and identify vulnerabilities, we applied a gray-box approach, conducting tests with partial access to the client's technical documentation.

We combined manual analysis techniques with automated scanning tools, utilizing Metasploit and Paros Proxy.

Gray-box

The team had limited access to internal information — this approach allowed us to effectively combine an external perspective with an internal system analysis.

Key project stages and solutions

During the project, the Datami team carried out a highly accurate, full-scale security assessment of the LMS Collaborator web platform, servers, and applications. A gray-box approach was chosen for the penetration test, combining both automated and manual testing methods.

The team made strategic decisions to enhance access control and strengthen the security of web applications.

Key project stages:

Preparation

Review of technical documentation, agreement on the approach, and identification of critical assets for testing.
Testing

Execution of gray-box penetration testing using Metasploit, Paros Proxy, and manual auditing to identify vulnerabilities.
Analysis and Reporting

In-depth analysis of identified risks, and preparation of a report with recommendations for risk mitigation and HIPAA compliance.

Results and recommendations

At the start of the project, LMS Collaborator was assessed as having a high-risk level due to vulnerabilities in web applications and potential data leaks, posing a threat to HIPAA compliance.

During the penetration test, the Datami team identified 15 vulnerabilities, 5 of which were critical. Some of these could have been exploited to gain unauthorized access to user accounts or extract sensitive information.

The client received the following recommendations:

regular security testing and updates;
strengthening access control;
cyber hygiene training for staff.

After implementing the recommended measures, LMS Collaborator achieved full HIPAA compliance, and its overall security level significantly improved. Two-factor authentication and regular security updates were introduced. All critical vulnerabilities were eliminated within 24 hours of reporting, preventing data breaches, penalties, and reputational damage.

The project was completed in 4 weeks, outperforming the industry average of 6 weeks.

Key project outcomes

DAVINTOO UKRAINE LLC successfully enhanced the cybersecurity resilience of LMS Collaborator and achieved full HIPAA compliance. The company gained a clear understanding of its threat landscape, a thorough technical audit, and actionable recommendations for strengthening its security systems. All project objectives were met within the planned timeframe.

This case study demonstrates that security testing and compliance are not just formalities, but essential safeguards against real-world threats and reputational damage.

Aspect

Before the project

After implementation

Security status

High risk due to critical vulnerabilities

HIPAA compliance achieved, risks reduced, regular updates implemented

Critical vulnerabilities

Potential data leaks and unauthorized access

5 critical vulnerabilities resolved within 24 hours

Account compromise risk

Unreliable authentication

Two-factor authentication (2FA) and enhanced access control implemented

Security compliance

Partial HIPAA compliance

Full readiness for certification

Timeline

Industry standard: 6 weeks

Completed in 4 weeks

Case: Scheduled Penetration Testing of Mobile Applications and Internal Network

Critical, medium, and low vulnerabilities were identified in mobile applications and the network
Risks were demonstrated through public Wi-Fi access and bypassing network restrictions

Services:

Mobile app pentesting, infrastructure penetration testing

Jun 20, 2025

Distribution Company Case: Penetration Test with Red Teaming Elements

21 vulnerability identified: 8 medium, 12 low, and 1 informational
Simulated internal attack: Wi-Fi password successfully cracked

Services:

Black-box penetration test with elements of Red Teaming

Jun 6, 2025

Case Fraudline: Scheduled Pentest of a Whistleblowing Platform

Identified 6 technical vulnerabilities: 5 low-risk and 1 informational
Performed additional manual testing of business logic

Services:

automated gray-box pentest, audit of secure coding practices, additional manual review of business logic

May 23, 2025

Back to all cases

The Equifax Data Breach: A Preventable Catastrophe

Datami Newsroom

The Equifax Data Breach: A Preventable Catastrophe

This incident occurred back in 2017, but cybersecurity experts are still studying it in detail. This case features a series of classic security failures – serving as a clear example of what not to do.

Jun 30, 2025 3 min

Unconventional Records: Pentesters Hacked a Tesla in Just 2 Minutes

Datami Newsroom

Unconventional Records: Pentesters Hacked a Tesla in Just 2 Minutes

Today, all it takes to take over a car is a computer. That’s exactly what hackers demonstrated at a special competition - they hacked a Tesla in just 120 seconds, and the result became a true sensation.

Jun 27, 2025 3 min

Top 5 Reasons to Invest in Penetration Testing in 2025

Datami Newsroom

Top 5 Reasons to Invest in Penetration Testing in 2025

Today, nearly every business is closely connected to the internet: websites, mobile apps, cloud data storage, electronic payments, and more. This brings great convenience, but at the same time, it introduces additional risks and potential financial losses

Jun 25, 2025 3 min

On this page you will learn what cookies are and how and when we use them. Definition of the term Cookies Cookies are pieces of data that a web server generates and that a website stores on your user device (computer, smartphone, tablet, etc.). Each website or third-party service sends cookies to the browser installed on your device only if your browser allows it. This is possible if you have not set any restrictions in your browser settings to save cookies. Browsers are a very well thought out technology. They protect personal data and allow websites to access only cookies that were previously sent to them. Cookies are divided into: session cookies. They are stored in the memory of the browser only during your session, after leaving the site immediately removed. permanent. They are stored in the memory of the browser for a long time. Definition of the term “browser” A browser is an application for browsing websites. The most popular browsers are Chrome, Internet Explorer, Firefox and Safari. All listed browsers are safe. In the settings of these browsers, cookies can be easily disabled, as well as change the settings of their work. You can: accept all cookies; ask the browser to notify when cookies are used; do not accept cookies. Cookies on ak1-3.com.ua and how we use them We use cookies to: our site is more functional; to understand how you navigate on the site, what content you consume better, to develop the content strategy of the site; understand how many visits to the site were per day, month, year. Analyze the geographical identity of users of the site, the number of repeated visits and other data. Cookies that we use on our site. Third-party cookies. The buttons of social networks, videos and some other services of our site are the property of other companies. These companies may also use cookies on your device if you have used them on our site or have been previously registered with them. The privacy policy of the use of personal data by these services can be found on the websites of these services. Blocking cookies All browsers allow simple actions to disable cookies. To disable them, you must go to your browser settings and find cookies in them. But we must remember that blocking cookies can have a negative impact on the performance of many websites. How to delete files You can also always delete cookies that are stored on your computer. To do this, follow the instructions of your browser Again, deleting cookies can have a negative effect on the performance of many websites.