Real Attacks. Real Consequences.

The Cyber Threat to
Dental & Medical Practices

These aren't hypotheticals. Real practices — many just like yours — have been shut down, fined, and forced to close because of ransomware and data breaches. Here's what you need to know.

The Numbers Are Staggering

58%

Surge in healthcare ransomware attacks in 2025

$7.42M

Average cost of a healthcare data breach in 2025 — highest of any industry for 14 consecutive years

$1.02M

Average recovery cost excluding ransom payment

190M

Patient records stolen in the 2024 Change Healthcare attack alone

60%

Of small businesses that suffer a major breach close within 6 months

$1,000

What a single stolen medical record sells for on the dark web — vs. a few dollars for a credit card

Sources: Sophos State of Ransomware in Healthcare 2025 · IBM Cost of a Data Breach Report 2025 · DialogHealth · HIPAA Journal · HFMA

Real Attacks. Real Damage.

These incidents happened to real practices. Read what went wrong — and what it cost.

National Impact

Change Healthcare — February 2024

Source

The largest healthcare cyberattack in U.S. history. BlackCat ransomware group exploited a single missing control — no multi-factor authentication on a remote access portal.

What Happened:
  • Protected health information of 190 million Americans stolen
  • Claims systems offline for weeks — providers couldn't bill insurance
  • Thousands of small practices pushed to the brink of closure
  • UnitedHealth Group paid $3.09 billion in direct response costs in 9 months
  • More than $9 billion in emergency loans issued to keep providers solvent
The Lesson

The entire attack hinged on one missing control: MFA. One checkbox would have prevented the largest healthcare breach in history.

Dental Industry

400+ Dental Practices — Ransomware Outbreak

Source

A single ransomware attack propagated through shared dental IT infrastructure, simultaneously locking down over 400 dental offices across the country.

What Happened:
  • Practices unable to access patient records, X-rays, or scheduling systems
  • Appointments cancelled for days to weeks across hundreds of locations
  • Patient care disrupted — some procedures delayed or rescheduled indefinitely
  • Ransom demands issued to each practice individually
  • Many practices had no backup systems — data was unrecoverable
The Lesson

Dental practices share software and IT vendors. One breach in the supply chain can hit hundreds of offices simultaneously — even if your own security is decent.

Recent Breach

Absolute Dental — February 2025

Source

A Nevada-based dental group with 50+ locations discovered a breach that exposed data on over 1.2 million patients.

What Happened:
  • 1.2 million patient records compromised across 50+ locations
  • Names, Social Security numbers, dates of birth, and treatment data exposed
  • HIPAA breach notification required for all affected patients
  • OCR investigation initiated — potential fines pending
  • Ongoing legal liability from affected patients
The Lesson

Size doesn't protect you. Multi-location dental groups are high-value targets precisely because of the volume of patient data they hold.

Small Practice

Small Practice — "We Thought We Were Too Small to Target"

Source

A single-dentist practice in the Midwest was hit with ransomware on a Tuesday morning. By Thursday, they were considering closing permanently.

What Happened:
  • All patient records, X-rays, and treatment histories encrypted and inaccessible
  • No working backup — the last backup was 8 months old
  • Ransom demand: $45,000 in Bitcoin
  • $180,000 total recovery cost including IT forensics, new hardware, and lost revenue
  • Practice was offline for 3 weeks — patients transferred to competitors
The Lesson

Attackers don't care how many chairs you have. Automated ransomware scans the internet for vulnerable systems — your ZIP code and revenue don't factor in.

What Cyber Insurers Now Require

Cyber insurance has fundamentally changed. Carriers no longer accept checkbox applications — they want documented proof of every control.

Missing even one of these can result in a denied application, a denied claim after an attack, or dramatically higher premiums.

Multi-factor authentication (MFA) on ALL systems — not just email
Encrypted, tested, offsite data backups
Documented incident response plan
Annual staff security awareness training with records
Endpoint detection & response (EDR) software on all workstations
Quarterly vulnerability scans with remediation logs
Third-party vendor risk assessments
Network segmentation separating PHI systems from general use
Real-World Warning

The City of Hamilton, Ontario had cyber insurance — but their claim was denied after a major ransomware attack because MFA had not been fully implemented across their environment. Having a policy is not the same as having coverage that will actually pay.

Don't Wait Until It Happens to You

PracticeGuard helps dental and medical practices implement every control on the list above — so you can prevent an attack, qualify for coverage, and sleep at night knowing your patients' data is protected.