PROGRAMS
ESSENTIALS TRAINING RANSOMWARE FREE COURSE MYLA SAFE LEADERSHIP MYLA CONSULTING
RESOURCES
BLOG DENTAL TRAINING REQUIREMENTS DENTAL AI RISK FRAMEWORK DENTAL PRIVACY LAWS DENTAL BREACH CASES DENTAL CONFERENCES 2027
CERTIFICATION
ACCOUNT
ADMIN MEMBER AFFILIATE
ABOUT US
ABOUT US MYLA SAFE FRAMEWORK ARTICLES & INTERVIEWS FAQ's
Book a call
A dentist and two team members reviewing information together on a computer at the front desk

Dental Breach Cases and What You Can Learn From Them

What dental breach notices donā€™t tell you

If you have researched dental breaches online, you have probably noticed that most notices say something happened, and very few explain how. These seven real cases show the root cause behind each one, and the simple habits that prevent them.

Every case on this page comes from a regulator decision or settlement, where the cause was investigated and written down.

We start in Ontario, with a decision that shows why clear policies, solid agreements and regular team training make such a difference.

Privacy laws differ by province and country. Where a finding comes from one specific law, we say so, and our province-by-province privacy guide shows what applies where you practise.

Last reviewed October 2026. Sources are linked under every case.

How to read each case

  • Numbered steps show the chain of events, in order.
  • Coral marks the breach and its root cause.
  • Blue boxes show what your practice can do about it.
Plain-language guide to the terms on this page
Phishing
An email or message made to look trustworthy, so someone clicks a link or shares a password.
Multi-factor authentication (MFA)
A second check at login, such as a code on your phone, so a stolen password alone is not enough.
Ransomware
Software that locks your files and demands payment to unlock them.
Encryption by attackers
When ransomware scrambles your data so your team can no longer open it.
Exfiltration
Copying data out of your systems to somewhere the attacker controls.
Administrator account
A login with the power to change settings and reach everything on a network.
Zero-day flaw
A weakness in software that attackers find before the maker has a fix ready.
Remote management tool
Software that lets an IT provider reach and manage your computers from elsewhere.
PHIPA and the Information and Privacy Commissioner
Ontario's health privacy law, and the Information and Privacy Commissioner who oversees it.

Five Ontario hospitals and one health clinic, 2023. Decided by Ontarioā€™s Information and Privacy Commissioner in 2025.

PHIPA Decision 284: when your IT provider is attacked, the responsibility stays with you

Root cause: administrator accounts without strong protection, at a shared IT provider

The short version: attackers got into a shared IT provider through three administrator accounts, copied patient records and locked servers. Ontario's Information and Privacy Commissioner found that weak protection on those accounts likely contributed, the clinic's IT agreement lacked key protections, and patients were only partly told.

Hundreds of thousandspatients whose records were copied
3 accountsadministrator logins used to get in
6 organizationsrelying on one IT provider

How it happened

  1. One shared providerTransForm Shared Service Organization ran the network for five hospitals and a clinic, including the clinic's email and shared drives.
  2. Admin accounts takenAn attacker entered through three compromised administrator accounts. The commissioner found these lacked privileged account controls, including multi-factor authentication.
  3. Data copied and lockedRecords of hundreds of thousands of patients were copied out, and many servers were encrypted.
  4. Published onlineThe attackers later posted the stolen information on the dark web.
  5. Incomplete noticePatient notices left out that data had been locked. The commissioner found locking is itself a breach that requires notice.

What the Information and Privacy Commissioner found

The commissioner's investigator reviewed both IT service agreements. The hospitals' agreement was comprehensive and in keeping with their obligations under PHIPA. The clinic's agreement covered technical support well, but it lacked key privacy and security protections. According to the decision, these four were missing:

  • Ownership and controlConfirmation that the clinic keeps ownership and control of its patients' health information.
  • Limits on useClear limits on how the provider could collect, use and share that information.
  • Staff trainingPrivacy and security training requirements for the provider's staff.
  • Proof of complianceA requirement to follow PHIPA, and a way for the provider to show that it does.

The investigator referred the clinic to the contract terms the commissioner's office recommends, and the clinic has since revised its agreement to match.

What the Information and Privacy Commissioner expects

Your IT provider secures the network. They do not carry your accountability. The commissioner's summary of the decision lists these safeguards:

  • Due diligence on providersCheck that your IT provider protects patient information well.
  • A complete service agreementPrivacy and security terms in writing, and monitoring that they are followed.
  • Strong loginsPassword management and multi-factor authentication.
  • Watching admin accountsMonitoring administrator accounts and logging access.
  • Protected backups and early warningBackups kept safe from tampering, and systems that spot suspicious activity early.
  • Regular team trainingOngoing privacy and cybersecurity training for staff.

What your practice can take from this

  • Pull out your IT provider agreement this month and check it for the four protections the clinic's agreement was missing. Ask for any gaps to be added.
  • Ask your IT provider two questions: do administrator accounts use multi-factor authentication, and who watches them?
  • Make training a regular habit for the whole team, and keep a record of who completed it and when.
  • If ransomware ever locks patient records, check your duty to notify. In Ontario, patients must be told even if nothing appears to have been stolen. Check the rules for your province.

Build this with Myla: Myla Essentials team training includes certificates and an admin dashboard, so you always have a record of who completed what. For owners and office managers, the Myla SAFE Leadershipā„¢ Program builds the written policies, access controls and responsibility matrix this decision points to.

Sources: Information and Privacy Commissioner case of note, Decision summary, PHIPA Decision 284 (full text)

Dental plan administrator, New York, 2021

Healthplex: one phishing link and a mailbox holding 12 years of email

Root cause: stolen password, no multi-factor authentication

The short version: an employee typed her password into a fake login page. With no second check at login, that was enough to open more than 12 years of stored email.

Tens of thousandspeople whose data was exposed
1 emaila phishing link started it
$2.4 millionin state settlements and penalties

How it happened

  1. A convincing emailA phishing email linked to a fake login page that asked for a username and password to view a PDF, according to the Attorney General.
  2. Credentials enteredAn employee of more than 20 years typed in her email login.
  3. No second checkThe recently launched Office 365 web login had no multi-factor authentication, so the password alone was enough.
  4. Years of stored emailThe mailbox held more than 12 years of email, including member enrolment information.
  5. Hard to measureThe logs could not show which emails the attacker opened.

The breach came to light when coworkers started receiving phishing emails from the compromised account.

Outcome

The New York Attorney General settled with Healthplex for $400,000 in December 2023, finding gaps in data retention, logging and multi-factor authentication. Healthplex admitted no wrongdoing. In August 2025, the Department of Financial Services added a $2 million penalty and found that Healthplex waited more than four months to notify the Department, where its rules require 72 hours.

What your practice can take from this

  • Turn on multi-factor authentication for every way into email, including web and phone access.
  • Set an email retention schedule so years of patient information stop collecting in inboxes.
  • Ask your IT provider to confirm logging is on, so you can tell exactly what was viewed if something happens.
  • Teach the team that a login page appearing after an email link is a moment to stop and check.

Build this with Myla: Cybersecurity Essentials teaches your whole team to spot phishing emails before anyone clicks.

Sources: NY Attorney General Assurance of Discontinuance, NY Department of Financial Services, GovInfoSecurity, TechTarget

Dental insurer, California, 2023

Delta Dental of California: a flaw in trusted file transfer software

Root cause: vulnerability in third-party software

The short version: a tool used to send files securely had a hidden weakness. Attackers found it first and used it against thousands of organizations at once.

6.9 millionpeople whose information was accessed
4 daysof access, May 27 to 30, 2023
2,680+organizations hit by the same flaw

How it happened

  1. An unknown flawMOVEit Transfer, a widely used file transfer product, had an undiscovered SQL injection weakness (CVE-2023-34362).
  2. Mass exploitationThe Clop ransomware group used the flaw to break into thousands of organizations at once.
  3. Data accessedAttackers reached Delta Dentalā€™s data, including names, financial account numbers and card details.
  4. DiscoveryThe vendor disclosed and patched the flaw on May 31. Delta Dental discovered the breach on June 1.

Security firm Emsisoft counted more than 2,680 affected organizations and close to 91 million people across the whole MOVEit campaign.

What your practice can take from this

  • Keep a simple list of every tool that stores or moves patient information, including portals and file sharing services.
  • Know who to call at each vendor, and ask how quickly they apply urgent security fixes.
  • Delete files from transfer and sharing tools once the transfer is done, so less sits there waiting.

Build this with Myla: The free SAFE Scoreā„¢ assessment includes vendor risk, covering agreements, access and oversight, so you can see where your practice stands.

Sources: BleepingComputer, SecurityWeek, Infosecurity Magazine, TechTarget

Dental backup service and its IT vendor, Wisconsin, 2019

DDS Safe: when the backup service became the way in

Root cause: compromised vendor remote management tool

The short version: the tool a vendor used to back up practices' data was turned against them, locking files at hundreds of offices in one day.

About 400dental practices affected
1 vendor toolused to reach them all
100+ officeshit in a similar attack three months later

How it happened

  1. Vendor tool targetedThe Wisconsin Dental Association's insurance arm reported that ransomware was deployed through the remote management software used to back up client data.
  2. Hundreds of offices at onceOn August 26, 2019, files at about 400 practices were encrypted using the REvil (Sodinokibi) strain.
  3. Partial recoveryReports indicate the vendor obtained a decryption tool, though some offices said it failed to unlock all of their files.

Three months later, a similar attack on a Colorado IT provider affected more than 100 dental offices. Practices that had usable off-site backups were able to recover, while others had to negotiate on their own.

What your practice can take from this

  • Keep at least one backup copy that your vendors' remote tools cannot reach or change.
  • Test a restore on a regular schedule, so you know your backup works before you need it.
  • Ask your IT provider how their own remote access is protected, including multi-factor authentication and monitoring.

Build this with Myla: Take the free 15-minute ransomware prevention course with your team, then use the SAFE Scoreā„¢ assessment to check your backups and response plan.

Sources: Krebs on Security (DDS Safe), BankInfoSecurity, Krebs on Security (Colorado IT provider)

Several US dental practices, settled 2019 to 2023

Replying to online reviews: a breach with no hacker involved

Root cause: staff disclosure of patient information

The short version: practices defended themselves against bad reviews and, in doing so, shared patients' names, treatment and insurance details in public.

$10,000 to $50,000paid by individual practices
3,658 patientscontacted in one misuse of a patient list
0 attackersevery disclosure came from inside

What happened

Elite Dental Associates in Dallas replied to a Yelp review with the patient's last name, treatment plan, insurance and cost details. The US Office for Civil Rights found the practice had done the same with other patients, and it paid $10,000 in 2019.

New Vision Dental in California answered reviews using patients' full names, even where Yelp showed only a nickname, and added visit and insurance details. It paid $23,000 in 2022. A North Carolina practice received a $50,000 civil monetary penalty for a similar reply.

In a related case, Northcutt Dental shared the contact details of 3,658 patients with a campaign manager, who mailed them about the dentist's run for state senate.

How it happened

  1. A negative reviewA patient posts an unhappy review online.
  2. A defensive replyThe practice responds to tell its side of the story.
  3. Details sharedThe reply confirms the person is a patient and adds treatment, insurance or visit details.
  4. A complaintThe patient complains to the regulator, which then reviews the practice's wider privacy program.

What your practice can take from this

  • Remember that confirming someone is your patient is itself a disclosure.
  • Use one calm, general reply for every review, inviting the person to call the office directly.
  • Decide in writing who is allowed to respond to reviews, and use patient lists only for patient care.

Build this with Myla: Privacy Essentials covers the need-to-know rule and everyday breach prevention, in plain language for the whole team.

Sources: Fierce Healthcare (Elite Dental), TechTarget (New Vision Dental), ArentFox Schiff, SC Media (Northcutt Dental)

Multi-location dental practice, Indiana, 2020

Westend Dental: how the response turned an attack into a larger problem

Root cause of the harm: incident response and recovery

The short version: ransomware locked a server the practice could not restore. Instead of investigating and telling patients, the practice later described it as an accident.

450+patients at the affected location
1 x-ray requestis how the state found out
$350,000settlement with the state

What happened

Around October 20, 2020, the Medusa Locker ransomware group encrypted a server at the practice's Arlington location. According to the Indiana Attorney General, the practice was unable to recover the patient files. The public record does not say how the attackers first got in. What it documents clearly is what happened next.

How it unfolded

  1. Server encryptedRansomware locked the server and left a ransom note.
  2. No investigationThe state alleged no forensic investigation was done and nobody was notified.
  3. A different storyA notice filed in 2022 blamed an accidentally formatted hard drive.
  4. A patient asksA patient who could not get copies of their x-rays complained to the state.
  5. SettlementRecorded calls with the software vendor confirmed the ransomware. The practice settled without admitting wrongdoing.

The state's review also found patient information shared in replies to online reviews, the same issue as the case above.

What your practice can take from this

  • Write a short incident response plan with names and phone numbers, and keep a printed copy.
  • Call your IT provider and cyber insurer early. A proper investigation tells you what you need to report.
  • Report within the required timelines and describe events honestly. Clear communication protects patient trust.

Build this with Myla: The Myla SAFE Leadershipā„¢ Program includes a breach response procedure and an incident response checklist built for your practice.

Sources: Indianapolis Business Journal, HIPAA Journal, BankInfoSecurity, National Law Review

Dental marketing and patient communication software vendor, Maryland, 2020

MMG Fusion: a vendor breach practices never heard about

Root cause of the harm: the vendor did not report

The short version: a vendor holding appointment and contact details for dental practices was breached, and the practices were never told. The data later turned up on the dark web.

About 15 millionpatients whose details were taken
5+ yearsfrom the breach to settlement
$10,000settlement, reflecting the vendor's finances

What happened

In December 2020, someone gained access to the systems of MMG Fusion, according to the US Department of Health and Human Services. The company sent appointment reminders and marketing for dental practices. The information taken included names, phone numbers, addresses, email addresses, dates of birth and appointment times. Public documents do not describe how the attacker got in.

How it unfolded

  1. Systems accessedAn unauthorized person reached patient data held for client practices.
  2. SilenceThe incident was not reported to the dental practices or to regulators.
  3. Data surfacesThe information was posted on the dark web, and a complaint reached the Office for Civil Rights.
  4. SettlementIn March 2026, the vendor settled and agreed to assess the 2020 attack so affected practices can be told.

What your practice can take from this

  • Make sure every vendor agreement requires prompt notice to you if patient information is affected.
  • Share only the patient details a vendor needs to do its job.
  • Review your vendor list once a year and remove tools you no longer use.

Build this with Myla: The free SAFE Scoreā„¢ assessment looks at vendor risk alongside four other areas, and shows which one deserves attention first.

Sources: US Department of Health and Human Services, Saul Ewing, Health Tech Authority

What these cases have in common

Look across all seven and the same four themes keep returning. Each one is something a practice can plan for.

Which themes appear in each case
CaseLogins and passwordsVendors and IT providersPeople and policiesResponse and reporting
PHIPA Decision 284YesYesYesYes
HealthplexYesYesYes
Delta Dental of CaliforniaYes
DDS SafeYesYes
Online review repliesYes
Westend DentalYesYes
MMG FusionYesYes
Cases2 of 74 of 74 of 75 of 7

  • Logins and passwords

    A stolen password opened years of email, and poorly protected admin accounts opened a whole network. A second login check is one of the simplest protections there is.

    Cybersecurity Essentials training

  • Vendors and IT providers

    Four of the seven began at a vendor. As the Ontario decision makes clear, your responsibility for patient information stays with you.

    Check your vendor risk with the SAFE Scoreā„¢

  • People and policies

    A clicked link, a defensive review reply, a missing contract clause. Clear policies and regular training make the right choice the easy one.

    Explore Myla Essentials team training

  • Response and reporting

    Working backups, a real investigation and timely, honest notice shaped how many of these stories ended.

    Watch the free ransomware course

Frequently asked questions

If our IT provider is breached, is it still our responsibility?

Generally, yes, although the exact rules depend on where you practise. Under the federal privacy law, PIPEDA, an organization stays responsible for information it transfers to a third party for processing, and must use contracts or other means to protect it. In Ontario, for example, PHIPA Decision 284 found that outsourcing does not remove a health information custodian's responsibility, and that practices should check their provider's protections and have a complete service agreement. To see which laws apply to you, use our province-by-province privacy guide. The SAFE Scoreā„¢ assessment also includes vendor risk if you would like a starting point.

Do these lessons apply outside Ontario, or outside Canada?

Yes. The root causes behind these cases, such as stolen passwords, weak vendor safeguards and staff disclosures, can affect a practice anywhere. What changes is the law: who you report to, how quickly, and what your notice must say. Canadian practices can check the rules for their province in our province-by-province privacy guide. Practices outside Canada should check with their local privacy regulator.

Does a ransomware attack need to be reported if no data was stolen?

It depends on where you practise. In Ontario, for example, the Information and Privacy Commissioner has found that encryption by attackers is an unauthorized use and loss of health information, which requires notifying patients even when nothing is stolen. Where the federal law, PIPEDA, applies, organizations must report breaches and notify individuals when a breach creates a real risk of significant harm. Other provinces have their own health privacy laws, so check the rules for yours in our province-by-province privacy guide.

Can we respond to a negative online review?

You can reply, as long as the reply shares no patient information, including the fact that the person is a patient. Several dental practices paid settlements or penalties after replies included names, treatment or insurance details. Those examples come from US regulators, and Canadian privacy laws set their own rules on disclosure, which vary by province. A general reply inviting the person to call the office is the safe approach everywhere. Privacy Essentials covers this with real scenarios.

Why do most breach notices leave out how it happened?

Notices are written early, often before an investigation is finished, and they focus on what information was involved. The cause usually becomes public later through regulator investigations, settlements and decisions, which is where these case studies come from.

Where can I find more answers about privacy, cybersecurity and AI in dentistry?

Our full FAQ covers common questions, and our province-by-province guide shows the privacy laws and training requirements that apply where you practise.

Turn these lessons into everyday habits

Myla Essentials training walks your whole team through situations like these in short, practical lessons built for Canadian dental practices. Wondering where to start? The free SAFE Scoreā„¢ shows which area deserves attention first.

Explore team training Get your free SAFE Scoreā„¢

These summaries are based on public regulator documents and published reporting, linked under each case. Most US cases were resolved through settlements in which the organization did not admit wrongdoing, and findings are described as the regulator reported them. This page is for education and is not legal advice. Privacy laws vary by province, territory and country.