Dentistry at Risk: Best Practices to Prevent and Counter Cybersecurity Incidents
Claims stop moving, patient records get locked, and staff can’t verify coverage. Then letters go out telling patients their information was exposed. That is what cybersecurity incidents do to dental practices, and the alleged DireWolf ransomware attack on eAssist Dental Solutions in September 2026 shows how one billing vendor can involve thousands of practices.
This blog explains why dental billing data attracts attackers and reviews earlier incidents at MCNA, Delta Dental of California, Henry Schein, and Change Healthcare. It summarizes HIPAA duties and lists proactive steps: risk analysis, multi-factor authentication, patching, encryption, offline backups, staff training, and vendor review. It then walks through how to respond when an incident occurs by containing systems, preserving evidence, reporting to federal agencies, notifying on time, and keeping billing running, with safeguards built for payments, remittances, and downtime. It closes with a practical checklist that helps practices evaluate the security of a billing partner.
For dental practices, cybersecurity incidents used to be an occasional IT problem. These days, they’re a daily business risk. Ransomware groups now go after the organizations that hold claims, patient identities, and payment details. The alleged DireWolf attack on eAssist Dental Solutions in September 2026 is the latest reminder.
If you run or manage a dental practice, this guide gives you a clear picture of what happened, what federal data shows, and what to do before and after an incident, and how to choose a reliable partner that offers encrypted dental billing services, keeping your data secured.
Secure Your Claims, Data & Revenue with a Reliable Dental Billing Partner
Why Cybersecurity Incidents Now Threaten Dental Practices?
Dental billing touches almost every sensitive piece of data a practice owns. A single claim file can hold a:
- Patient’s name
- Date of birth
- Address
- Subscriber Social Security Number
- Insurance member ID
- Clinical narratives
- Attached radiographs
Payment files add bank account and card details, while credentialing files add license numbers and tax IDs.
That mix is valuable to criminals. It supports identity theft, insurance fraud, and payment redirection scams. It also gives attackers leverage, because a practice that can’t submit claims or post payments starts losing cash flow within days.
Three reasons make dental billing an attractive target:
- Concentrated data: Billing companies and clearinghouses hold records from many practices at once, so one successful intrusion reaches all of them.
- Time pressure: Claims, eligibility checks, and payment posting run every day. Downtime is expensive, so attackers expect fast payment.
- Uneven defenses: Many small practices have no dedicated IT staff, and vendors often connect through shared logins, remote access tools, and older software.
Modern ransomware groups usually run double extortion. They copy your data first, then encrypt your files so your team can’t work, and then threaten to publish what they took. Restoring from a backup solves the second problem but does nothing about the first.
As per HHS Office for Civil Rights (OCR), hacking and ransomware are the most frequent types of breach reported to the agency. For dental practices, that means the question is no longer whether these attacks happen, but how ready your practice and your vendors are when they do.
What We Know About the Alleged eAssist and DireWolf Ransomware Attack?
On September 6, 2026, the DireWolf ransomware group listed eAssist Dental Solutions, a Utah-based dental billing and RCM company, on its dark web leak site. Attacker claims to have stolen about 26 GB and 12.8 million database rows. Tracking sites, such as Ransomware.live, recorded the listing the same day.
Two days later, eAssist told customers it was investigating a potential information security incident and had brought in outside experts. Neither eAssist nor its 70% owner Henry Schein had publicly confirmed what data, if any, was taken, and no verified list of affected practices has been published.
Speaking of DireWolf, it first appeared in May 2025. The group uses double extortion, and had claimed more than 118 victims by the end of August 2026. Healthcare organizations made up roughly 15% of its listings.
How Does the Incident Threaten Dental Practices?
eAssist is owned 70% by Henry Schein since 2021, and holds data of thousands of practices, something mentioned on the company’s official website. If proven, it can put patient confidential data, financial records, and a lot of information at risk.
So far, the event is an alleged and unconfirmed ransomware attack. Leak site claims can be exaggerated, and they can also turn out to be accurate. If your practice uses eAssist, don’t wait for certainty. Ask the vendor in writing what data they hold for you, request regular updates, review your business associate agreement, and check the HHS breach portal for any filing.
Details may change as the investigation continues.
The bigger lesson isn’t about one company. When a billing vendor is involved in an incident, the practice still answers to its patients for how their information was handled.
Which Notable Cybersecurity Incidents Affected Dental Practices and Payers in the Past?
eAssist is not the first time dental data has been exposed through a large organization. These earlier incidents show the same patterns:
- MCNA Dental (2023): The insurer found that attackers had been inside its network since late February 2023. Around 8.9 million people were notified. The LockBit group asked for $10 million. When MCNA refused to pay, the stolen data was published.
- Delta Dental of California (2023): Between May 27 and May 30, 2023, the Cl0p group took advantage of a vulnerability in the MOVEit file transfer tool to access data. About 6.9 million people were notified. The cause was a vendor software flaw, not a mistake by Delta Dental staff.
- Henry Schein (October 2023): A cyber incident disrupted parts of the company’s manufacturing and distribution businesses. Reports said the intruders were in the network for more than two weeks before detection, and the company later reported personal data on roughly 29,000 people was involved. The company stated that its practice management software was not disrupted.
- Change Healthcare (February 2024): A ransomware attack on this major claims clearinghouse interrupted claim submission, eligibility checks, and payments across healthcare, including dental practices. The final count on the OCR breach portal is 192.7 million people, the largest health data breach on record. The number began as a 500-person placeholder in July 2024 and was revised over about a year.
Notice what these have in common. Attackers rarely need to reach thousands of practices one at a time. They reach the shared system, whether that’s an insurer, a file transfer tool, a clearinghouse, or a billing company, and every connected practice inherits the problem.
What Federal Data and Enforcement Show for 2026?
Federal sources give a consistent picture of where healthcare stands this year:
- HIPAA Journal analysis of the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) breach portal shows more than 700 large breaches (500 or more people) reported in each of 2024 and 2025. Hacking and other IT incidents account for roughly four in five of them, and a business associate is involved in about one-third.
- On April 23, 2026, OCR announced four ransomware settlements totaling $1,165,000, covering breaches that affected more than 427,000 people. In each case OCR found the organization had not completed an accurate and thorough risk analysis. One of the four was a business associate. The HHS also notes that a phishing attack led to server access in one of the cases.
- CISA and the FBI publish the Stop Ransomware Guide, which covers prevention and gives a response checklist. Its core advice is to implement phishing-resistant multi-factor authentication, offline encrypted backups, and a tested response plan.
Regulators keep pointing to the same gap: organizations that never took a full inventory of where patient data is stored and what threatens it.
What are HIPAA Requirements at a Glance?
Let’s have a look at the HIPAA requirements for dental billing security:
- Security Rule: Requires administrative, physical, and technical safeguards for electronic protected health information, starting with an accurate and thorough risk analysis.
- Risk management and workforce duties: Practices must act on the risks they find, train staff, control access, record system activity, and keep a contingency plan that covers backups and recovery.
- Business associate agreements: Any vendor that handles patient data for you, including a billing company, must sign one.
- Breach Notification Rule: Individuals must be told without unreasonable delay and no later than 60 days after discovery. Breaches of 500 or more people also go to HHS, and to the media when they involve more than 500 residents of one state. Business associates must notify the covered entity.
- Proposed update: HHS proposed a major Security Rule revision in late 2024 that would make multi-factor authentication, encryption, and regular testing explicit requirements. It is not final, and the federal regulatory agenda now points to July 2027 for final action. The current rule remains in force and OCR continues to enforce it.
Practices that adopt these controls now won’t need to rush if the update is finalized.
How to Prevent Cybersecurity Incidents in Your Dental Practice?
Complete a Security Risk Analysis and Keep It Current
Start by listing every place patient data lives or moves. Then rate the risks and write a plan to reduce them. HHS offers risk analysis guidance and the 405(d) Program publishes practical cybersecurity practices for smaller healthcare organizations. Include these systems:
- Practice management and imaging software, on-site and cloud-based
- Email, file sharing, and text messaging tools
- Clearinghouse and payer portals, plus your billing vendor
- Backups, laptops, phones, scanners, and printers
Update the analysis every year and whenever you add a vendor, change software, or open a new location.
Turn On Multi-Factor Authentication Everywhere It Is Offered
Patch and Update Software on a Fixed Schedule
The aforementioned Delta Dental incident began with a flaw in a vendor’s file transfer tool. Attackers move quickly once a weakness is public, so set a routine for updates, and make sure to:
- Update operating systems, practice management software, imaging tools, firewalls, and routers
- Replace systems that no longer receive vendor security updates
- Ask your IT provider to send you a short monthly report showing what was updated
Encrypt Data and Limit Who Can See It
Keep Offline, Encrypted, and Tested Backups
Protect Payment and Claims Workflows
Billing has risks that general IT advice tends to miss. Put these controls in place:
- Require two people to approve changes to EFT or ERA enrollment and bank account details
- Compare bank deposits with remittance advice each month to catch redirected payments
- Review the user list on your clearinghouse and payer portals every quarter
- Set login alerts on the accounts that receive payments
Review Every Vendor That Touches Patient Data
List every vendor with access to patient information:
- Billing
- Clearinghouse
- IT Support
- Cloud Imaging
- Payment processing
- Answering Services
Confirm that each has a signed business associate agreement. Ask what security evidence they can share, how quickly they must tell you about an incident, and which subcontractors they use.
Write and Practice an Incident Response Plan
CISA recommends creating, maintaining, and exercising a response plan with a communication plan for ransomware and data extortion. Keep a printed copy, since you may not be able to open files during an attack. Your plan should include:
- Who leads the response and who makes decisions when that person is unavailable
- Contact details for your IT provider, billing vendor, cyber insurer, attorney, and a forensic firm
- Downtime procedures for scheduling, charting, and billing
- A yearly tabletop exercise where the team walks through a realistic scenario
Check your cyber insurance policy too. Many policies require prompt notice and may require you to use their approved responders.
How to Counter Cybersecurity Incidents When They Occur?
Contain the Affected Systems Immediately
Activate Your Response Team and Call Your Insurer
Preserve Evidence
Report to Federal Authorities
Decide Whether a Breach Occurred and Notify on Time
Under HHS guidance, a ransomware attack that encrypts patient data is treated as a breach unless you can demonstrate a low probability that the data was compromised through a documented risk assessment. Keep these points in mind:
- The 60-day notification period starts at discovery, not when the investigation ends
- Notify affected individuals, HHS, and the media when the rules require it, and check your state laws, which may set shorter deadlines or require attorney general notice
- If the incident happened at a vendor, get written notice from them and agree in writing on who will notify patients
- Amend your HHS filing if the number of affected people changes, as happened with Change Healthcare
Restore Carefully and Review What Happened
Support Affected Patients
Send plain-language notices that say:
- What happened
- What information was involved
- What you’re doing about it
- How patients can protect themselves
Offer credit monitoring where appropriate, set up a phone line or email for questions, and watch for fraudulent claims tied to affected patients.
How to Choose a Dental Billing Partner with Secured Infrastructure?
| What to check | What is the right answer |
|---|---|
| Business associate agreement | A signed agreement that sets a breach notice timeline and covers subcontractors |
| Independent assessment | A recent SOC 2 report, shared under confidentiality, plus a current risk analysis summary |
| Access controls | Multi-factor authentication for every account, unique logins, role-based access, and reviewed activity logs |
| Encryption | Patient data encrypted in transit and at rest, including backups |
| Backup and recovery | Offline or immutable backups, tested restores, and written recovery time targets |
| Incident response | A written plan tested each year, named contacts, and a firm commitment on how fast you will be told |
| Subcontractors and data location | A full list of subprocessors, where data is stored, and any offshore access disclosed |
| Data minimization and retention | Only the data needed for billing, a defined retention period, and certified deletion at contract end |
| Transparency | Willingness to discuss past incidents and what changed afterward, plus cyber liability insurance |
| Exit terms | Return of your data in a usable format when the contract ends |
Apply the same questions to the vendors you already use. A good time to ask is right now, while nothing is wrong.
When you’re making the switch, opt for a partner who confidently answers, such as TransDontics, who has a track record of helping practices recover their revenue while protecting their data with confidence. The biggest confidence you get in this partnership is that you’re able to access your systems and see live how your partner manages your patient records and processes claims.
Outsource Dental RCM with Confidence to a Partner that Offers Security with Guaranteed Terms
Final Takeaways
Cybersecurity incidents affect dental practices, payers, and billing vendors alike. The alleged eAssist attack shows how an incident with one vendor can compromise sensitive patient and financial data for thousands of practices. Details remain unconfirmed, so avoid assumptions, ask your vendors direct questions, and review your own exposure this week.
Prepare now: complete a risk analysis, enable multi-factor authentication, patch software, keep offline backups, train staff, and write a response plan. If an incident happens, contain it, report it, notify on time, and keep claims moving while systems recover. Each step lowers both patient harm and revenue loss.
