Dental practices got hacked 412 times in 2025. You're next.

Somebody is going to wave a tidy number at you this year about how many dental practices got breached, and they'll be guessing, because small-practice breaches under 500 records never become public. Here's what isn't a guess: 804 large healthcare data breaches were reported to HHS OCR in 2025, they affected 138.5 million individuals, and 604 of them came from healthcare providers, the exact bucket your practice sits in, according to HIPAA Journal's breach statistics.

Our view, and plenty of owners will fight us on it: the marginal dollar you spend on perimeter security is worth less than the marginal dollar you spend on making a locked schedule survivable. You are going to get phished eventually. The question that actually moves money is how many production days you lose between the click and the moment you're seeing patients again. Your practice doesn't get hacked by a hacker in a hoodie. It gets hacked by whoever opens the new-patient form at 8:40 on a Tuesday, doing exactly their job.

Nobody Can Tell You the Real Dental Number

The federal breach portal only forces disclosure at 500 records and up. A three-op practice with 2,400 active charts can get ransomed, pay, restore from a six-week-old backup, and never appear in a single public tally. So any confident count of "dental practices hacked" is built on the visible tip of the thing.

What's documented is worse than a count anyway. Research published in the Journal of Dental Education notes that since 2015, hacking and cybersecurity incidents have overtaken theft and improper disposal as the primary cause of U.S. healthcare data breaches. That's a structural shift, not a bad year. Physical loss of a laptop is random. A phishing campaign is a business with a target list, and dental is on it.

That same paper points to an August 2023 ransomware breach at a Midwest dental school that exposed patient, student, alumni, and employee data all at once. A dental school has an IT department, a compliance office, and a legal team on payroll. You have a practice manager and an IT guy who also services the orthodontist down the street.

The FBI Called the ADA Directly

On May 6, 2024, the FBI warned the American Dental Association and the American Association of Oral and Maxillofacial Surgeons about a credible, active cybersecurity threat campaign aimed specifically at dental and oral surgery practices, using phishing emails disguised as new-patient forms. That alert was reprinted by the New Jersey Dental Association.

Read the attack vector again: new-patient forms. Not a zero-day exploit. Not a firewall gap. An email that looks exactly like the twelve legitimate ones your front desk opens every morning, arriving in the inbox of the one person in the building whose entire job is to open attachments from strangers quickly and get the patient scheduled.

You cannot train that risk to zero. The behavior the attacker exploits is the behavior you hired for.

Three Practices, 38,211 Patients

Abstractions don't move owners, so here are named ones. HIPAA Journal's running log of dental incidents lists Bayside Dental with 10,216 patients affected, discovered January 5, 2026; Stafford Oral Surgery with 7,019 patients from a phishing attack that ran October 15 to 23, 2025; and Bridle Trails Family Dentistry with 20,976 patients.

That's 38,211 patient records across three practices that look like yours. None of them are hospital systems. None of them had a chief information security officer. And note the Stafford window: October 15 to 23. Eight days inside the system before anyone knew.

Eight days is enough time to read your fee schedule, your payroll, your bank details, and every treatment plan you have pending.

What Most Owners Get Wrong: The Vendor Is Not the Plan

The specific mistake, and it's near universal among owners of one to three locations who outsourced IT somewhere around 2018 and never reopened the contract: they believe they have bought a security program when what they've bought is a help desk.

Ask your IT vendor three questions and watch what happens. When was the last time you restored our practice management database from backup into a working environment, not just confirmed the backup file exists? What is our contractual restore time, in hours, and what's the penalty if you miss it? Is multifactor authentication enforced on every remote login and every email account, with no exceptions for the doctor?

Most owners get a version of "we've got you covered" on all three. That's not an answer. A backup nobody has restored is a hypothesis. An unenforced MFA policy is a preference.

The second version of this mistake is treating the cyber liability policy as the plan. It's a check that arrives in 60 to 120 days, minus your retention, after a claims adjuster reviews what you attested to on the application. Go pull your application right now and look at how you answered the MFA and backup questions. If the answer on that form doesn't match what's actually running in your building, you've bought an expensive maybe.

We'd stop paying for a monitoring dashboard nobody logs into and move that money to tested restores. Dashboards are visible to you. Restores are visible to your patients.

Six Locked Days Cost $127,500

Run the arithmetic on a practice you'd recognize. Take $1.6M in annual collections across 192 clinical days, which puts a day of production at roughly $8,333.

Ransomware locks the schedule for six days. That's $50,000 of production off the board. You'll rebook some of it, so assume you recapture 40 percent over the following quarter and eat $30,000 net.

Now the costs nobody budgets. Forensic incident response to determine what was actually accessed, because you cannot legally notify anyone until you know: call it $25,000. Written notification to 9,000 patients at $2.50 each for printing, postage, and the call center that handles the phone calls afterward: $22,500. Credit monitoring offered to all 9,000 with 12 percent taking it up, at $25 a head: $27,000. Breach counsel to manage state notification deadlines and the OCR correspondence: $15,000. Staff overtime plus temporary help rebuilding schedules and re-entering a week of paper charts: $8,000.

Total: $127,500. Your policy has a $25,000 retention, so at minimum that's cash out of the operating account before anyone reimburses anything.

Against that, price the boring side. Enforced MFA across email and remote access, a managed backup with quarterly restore tests you actually witness, endpoint detection, and quarterly phishing simulations for the whole team runs somewhere near $900 a month for a practice this size. That's $10,800 a year.

One incident pays for 11.8 years of the program. And the $127,500 figure assumes you don't lose a single patient over it, which is generous. Lose 30 active patients at $850 of annual value and that's another $25,500 a year, permanently.

Owners routinely approve a $140,000 CBCT on a five-year return story and balk at $900 a month on something with an 11.8-year payback on a single event. The difference isn't the math. It's that the scanner shows up in the operatory and the backup doesn't show up anywhere until the day it's the only thing standing between you and closing for a week.

Buy Recovery Time, Not a Taller Wall

Here's where we'll take the unpopular position all the way. Given the FBI's own description of the attack, a phishing email dressed as a new-patient form, you should assume the click happens. Budget as if it already did.

That reframes every spending decision. The question stops being "how do we keep them out" and becomes "how many hours from detection to seeing patients again." Every dollar should be graded against that clock. Immutable offsite backups shorten it. A tested restore procedure shortens it. Knowing which vendor phone number to call at 6 a.m. shortens it. A prettier firewall does not shorten it at all.

The practices that survive this well aren't the ones that never got hit. They're the ones that were back on the schedule Thursday instead of the following Monday. Four days of $8,333 is $33,332 in production, which is most of the difference between an incident and a crisis.

Do These Four Things Before Friday

Email your IT vendor today and ask for the date of the last full restore test of your practice management database, in writing, with the restore time in hours. Turn on multifactor authentication for every email account in the practice including yours, which takes about 20 minutes and costs nothing. Pull the cyber liability application out of the file and confirm every answer on it is still true, because that document is what the adjuster reads first. Then tell your front desk that any new-patient form arriving as an email attachment gets verified by phone before it's opened, no exceptions, and back them up when it slows a new patient down by four minutes.

What would change our position: if the restore-test question stops embarrassing IT vendors and becomes standard in service contracts, the calculus shifts back toward prevention spending. We're watching whether cyber insurers start requiring documented restore tests rather than just attestations, and whether the 2026 provider breach count runs above or below 2025's 604. If it climbs again, the recovery-time argument gets stronger, not weaker.

Before you approve any of this spending, know what a locked week actually costs you rather than the hypothetical practice above. Take your own collections, your own clinical days, and your own active patient count, put your current IT and security spend in as an overhead line, and see what percentage of collections you're really allocating to the thing that keeps your schedule running. Run your own numbers on the overhead calculator, then decide whether $900 a month is expensive.