Ransomware Attack on Your Dental Practice: What to Do Right Now

If you're reading this during an active attack, skip to "First 60 Minutes" below. If you're reading this to prepare, good - you're smarter than 90% of practices.

First 60 Minutes (Do This NOW)

1. STOP. Don't click anything else.

1. Don't try to open files to "check"
2. Don't restart computers
3. Don't pay the ransom (yet)

2. Disconnect from the network

1. Unplug ethernet cables from ALL computers
2. Turn off WiFi on ALL devices
3. This stops the spread

3. Take photos of the ransom screen

1. Use your phone
2. Get the bitcoin address, email, and any ID numbers
3. This helps forensics later

4. Call your cyber insurance (if you have it)

1. They have incident response teams on standby
2. They'll guide next steps
3. Don't wait - call immediately

5. Don't turn anything off

1. Forensics needs the machines running
2. Memory contains evidence that disappears on shutdown

First 24 Hours

Assess the damage:

1. Which computers are encrypted?
2. Are backups affected?
3. Is patient data exposed?

Activate your incident response plan:

1. If you don't have one, call an incident response firm
2. Your cyber insurance can recommend one
3. Don't try to handle this alone

Notify your IT provider:

1. If you have managed IT, they should already know
2. If you're using a "computer guy," this is beyond them
3. You need incident response specialists

Consider HIPAA breach notification:

1. Ransomware is presumed a breach unless proven otherwise
2. You may need to notify HHS within 60 days
3. You may need to notify patients
4. Document everything for compliance

The "Should We Pay?" Question

Arguments for paying:

1. Sometimes faster than recovery
2. May be only option if backups are gone
3. Insurance may cover it

Arguments against paying:

1. No guarantee you get files back
2. Funds criminal enterprises
3. Makes you a target for repeat attacks
4. May violate OFAC sanctions

Reality:

1. About 50% of practices that pay get data back
2. Average ransom: $50,000-150,000
3. Average recovery cost (without paying): $150,000-300,000
4. Your insurance company will have strong opinions

Recovery Process

If you have good backups:

1. Wipe all affected machines
2. Reinstall operating systems
3. Restore from backup
4. Verify no malware in backups
5. Harden security before reconnecting

If backups are compromised:

1. Negotiate with attackers (through professionals)
2. Pay if advised and legal
3. Decrypt and verify data
4. Full security rebuild anyway

Timeline:

1. Minimum 3-5 days to restore operations
2. Often 2-4 weeks for full recovery
3. 6+ months to verify no persistent threat

How This Happened

Most dental ransomware attacks come from:

Phishing emails (60%):

1. "Your dental supply invoice is attached"
2. Staff opens attachment, game over

Remote desktop exposure (25%):

1. RDP open to internet
2. Weak passwords

Unpatched software (10%):

1. Old operating systems
2. Outdated practice software

Infected websites (5%):

1. Malicious ads on legitimate sites
2. Drive-by downloads

Prevention (For Next Time)

1. MFA everywhere - Stops 99% of account compromises
2. Endpoint detection - Modern antivirus that catches ransomware
3. Offline backups - Air-gapped, can't be encrypted
4. Staff training - Phishing simulation, security awareness
5. Email filtering - Block malicious attachments before arrival
6. Network segmentation - X-ray systems separate from billing

The Real Cost

Beyond ransom and recovery:

1. Lost production: $5,000-20,000/day
2. Patient notification: $5-50/patient
3. Legal/compliance: $20,000-100,000
4. Reputation damage: Immeasurable
5. Staff overtime/stress: Immeasurable

Prevention costs: $200-300/user/month

The math isn't hard.

Think your practice is protected? We find vulnerabilities before attackers do. Get Free Assessment

Need Help With Your Practice’s Security?

Free assessment, no obligation, real answers.

Get Free Assessment

(469) 306-9520 • Serving Dallas-Fort Worth