The Ransom Note in the Waiting Room: When Ransomware Comes for Your Practice

A patient in Indiana called her dentist to ask for copies of her x-rays. The office told her they could not help. Someone had “hacked” the computers, they said, and the images were gone. She had never received a breach notice. She did not know that a ransomware attack had quietly hit the practice, that no forensic investigation was ever done, or that the office’s entire set of HIPAA policies sat in a binder at one location with no sign anyone had ever followed them. She just wanted her x-rays. What she set in motion instead, after she complained to the state, was a $350,000 settlement and a cautionary tale for every small practice in the country.

That is the real shape of healthcare cybercrime right now. The headlines go to the hospital chains, but the quiet, repeated, financially brutal attacks land on dental offices, family clinics, imaging centers, and specialty practices with a few locations and one part-time IT contact. They get hit not in spite of being small, but because of it.

Why a twelve-person dental office is a prime target

For years the assumption in small practices was comforting and wrong: we are too small to bother with. The data says the opposite. In Verizon’s 2025 Data Breach Investigations Report, ransomware was a factor in 88% of breaches at small and medium businesses, against 39% at large organizations. Attackers are not reaching small offices by accident. They are concentrating there.

The reason is a simple risk-to-reward calculation. A patient chart is worth far more to a criminal than a stolen credit card number, because a card can be cancelled in minutes and a medical record cannot. It carries a Social Security number, a date of birth, an insurance ID, a home address, and a permanent health history, which is everything needed for identity theft, insurance fraud, and targeted follow-on scams. A single 2025 breach at Absolute Dental, a Nevada group with more than fifty locations, exposed the data of over 1.2 million people, including Social Security numbers, driver’s license and passport details, and treatment information.

Now pair that value with the defenses. A typical practice runs on a busy front desk, an outside IT vendor who shows up when something breaks, and clinical software that gets patched late so updates do not interrupt the schedule. That last habit is more dangerous than it sounds. Exploited software vulnerabilities were the single leading root cause of healthcare ransomware in 2025. The valuable data and the thin defense sit in the same building, and the attackers know it.

How the attack actually works

Ransomware is malicious software that locks your files by encrypting them, then demands a payment for the key that unlocks them. The mechanics of getting it into a practice are less exotic than most people expect. Three doors account for the overwhelming majority of cases.

The first door is a phishing email. Someone on staff opens what looks like an invoice, a lab result, or an insurance notice, and a single click hands over a password or runs a hidden installer. Phishing has gotten dramatically more convincing: Microsoft’s 2025 Digital Defense Report measured a 54% click-through rate on phishing emails written by AI, against 12% for the human-written kind. The misspelled, clumsy scam email is going extinct.

The second door is remote access left open. Many practices and dental service organizations use remote desktop (RDP) so an IT contractor can log in after hours. When that connection faces the open internet without multi-factor authentication, it is an unlocked back door, and automated tools scan for it constantly. The third door is unpatched software, where a known and already-fixed flaw is left in place long enough for someone to walk through it.

Here is the part that surprises owners most. Modern crews do not encrypt first. They get in quietly, look around, and copy the patient database over hours or days before they ever lock anything. The encryption is just the alarm clock. By the time the screens go red and the ransom note appears, your data has already left the building. That is why restoring from a backup, while essential, does not end the problem. This shift from simple encryption to data theft plus encryption plus public leak threats is now the default, and some groups skip the encryption entirely and run on the threat to publish alone.

2025 was a roll call of small-practice breaches

These are not hypotheticals. A short list from a single year, all reported through the HHS breach portal and tracked by the HIPAA Journal, shows how routine this has become:

• Absolute Dental (Nevada, 50-plus locations): a February 2025 attack exposed more than 1.2 million records, including Social Security numbers and passport details.
• Chord Specialty Dental Partners (Tennessee): an email-account breach disclosed in 2025 exposed roughly 173,000 records.
• 32 Pearls (Seattle and Tacoma): ransomware encrypted systems over a four-day window in May 2025; about 23,500 current and former patients were notified.
• Tieu Dental (California): a July 2025 attack claimed by the SafePay group hit roughly 12,650 patients, exposing names, Social Security numbers, treatment plans, and insurance details.

The common thread is not technical sophistication. It is that each was a normal practice doing normal work, with defenses that were a step behind the people probing them.

The part most owners underestimate: the HIPAA bill

For a practice, the ransom is rarely the most expensive line item. The regulatory aftermath is. Under federal guidance, when ransomware encrypts electronic protected health information, it is presumed to be a reportable breach unless the practice can demonstrate a low probability that the data was compromised. That presumption is the trap. It means a ransomware hit is a HIPAA event by default, which triggers the duty to notify every affected patient, and for any breach of 500 or more records, to notify HHS and the media as well.

Then comes the investigation. The HHS Office for Civil Rights has run a Risk Analysis Initiative since late 2024, and the single most common finding across its ransomware settlements is the same sentence, over and over: the entity failed to conduct an accurate and thorough risk analysis. In April 2026 alone, OCR settled four ransomware cases covering more than 427,000 patients for a combined $1,165,000. One of them traced back to a single phishing email opened in July 2020. The penalties are not reserved for hospitals. They land on imaging centers, benefits administrators, and dental practices with the same language attached.

What to watch for

Because crews often sit inside a network for days before they trigger anything, the early signals are subtle and easy to wave off as “the computers being slow.” Train the whole team to flag these, not just the IT contact:

Five things to do this month

None of this requires a hospital budget. It requires deciding that the practice is a target and acting like one before the incident, not after.

1. Put multi-factor authentication on everything that faces outward. Email, remote access, and your practice-management login. If RDP is exposed to the internet, close it or place it behind a VPN with MFA today. This one change blocks the most common entry routes.
2. Keep offline, tested backups. A backup the attacker can also reach gets encrypted along with everything else. Keep at least one copy offline or immutable, and actually test a restore so you know it works.
3. Patch on a real schedule. Set a recurring window for updates to clinical software, the operating system, and network gear, and hold your IT vendor to it in writing.
4. Do the written risk analysis. It is required by the HIPAA Security Rule, it is the first thing OCR asks for, and its absence is the finding that turns a breach into a six-figure settlement. A current, documented analysis is the cheapest insurance you can buy.
5. Train and test your team. Since most attacks start with a person clicking, ongoing phishing practice is the highest-leverage habit a small office has. Our 30-day phishing-simulation rollout for small teams is a realistic starting point, and the broader social-engineering playbook for SMBs covers the rest.

The takeaway

The patient in Indiana did not bring down her dentist with a sophisticated hack. She just asked for her x-rays and would not let it go. The attack had already happened. The settlement came from everything the practice failed to do before and after. For a small office, the lesson is not that the threat is unbeatable. It is that the basics, MFA, backups, patching, a written risk analysis, and a trained team, are exactly what separate a bad week from a closed practice. The crews betting against you are counting on those basics staying undone.