Three Major Dental DSOs Got Hit By Ransomware This Summer. Yours Isn't Immune.

Absolute Dental, a Nevada network, ended up notifying 1,223,635 people that their data walked out the door after a nine-day intrusion in late February and early March, according to its filing with the Oregon Attorney General. That is more patients than most practices will see in forty years of chairside work, lost in a window shorter than a single hygiene recall cycle. The question facing you isn't whether somebody eventually encrypts your server. It's whether you can still see patients on the Tuesday after they do.

Here's the part of this story that gets told wrong, and the telling is what lets owners off the hook. The breaches that surfaced this summer were not all big corporate dentistry. One was a 1.2 million-patient network. One was 32 Pearls, a single Washington dental practice that confirmed a ransomware attack between May 19 and May 22, exposing Social Security numbers and medical records for 23,517 patients. The third was West Texas Oral Facial Surgery, an oral surgery group that notified 11,151 patients after a breach claimed by the Inc Ransom group. Our view: filing all three under "DSO problem" is the most expensive mistake in this category, because the two smaller organizations got hit the same way, lost the same class of data, and faced the same notification bill without anything resembling a corporate security budget behind them.

So the thesis an informed owner can argue with: we'd spend zero additional dollars on prevention tools until you have paid for the ability to produce revenue for five business days with your practice management software completely dark. Firewall upgrades, endpoint licenses, phishing simulations, all of it goes second. Recovery goes first. Plenty of IT consultants will tell you that's backwards. They sell prevention.

23,517 Patients Is Not a Corporate Number

The scale mismatch in the summer's disclosures is the whole lesson. A single practice in Washington exposed 23,517 patient records. For context, that is roughly the active and inactive patient base a mature two-doctor office accumulates over a couple of decades, and it is more than two times the patient count in the oral surgery breach. Attackers don't scale their targeting to your revenue. They scan for an open remote desktop port, an unpatched server, a credential someone reused on a dental supply vendor site, and then they take whatever is sitting behind it.

What's sitting behind it, in dentistry, is unusually rich. Your practice management database holds Social Security numbers for insurance verification, dates of birth, insurance IDs, treatment histories, and often card data on file for membership plans. Compare that to a retail breach where the attacker gets an email address and a shipping address. A dental record is a complete identity kit. That's why ransomware crews specifically work healthcare, and why the number of patients is the pricing mechanism for the whole event, not the size of your collections.

Why 89% of the Attack Surface Wears a Loupe

Consolidation gets blamed for everything in dentistry right now, and on security it's close to the opposite of the real exposure. In 2024, 11% of U.S. dentists worked in practices with 100 or more locations, per the ADA Health Policy Institute's workforce report, out of 202,485 dentists nationally. Flip it. Roughly 89% of the profession practices somewhere that does not have a chief information security officer, a 24-hour security operations center, a cyber incident retainer, or a tabletop exercise on the calendar.

Big networks are a bigger prize per intrusion, which is why Absolute Dental's number ran past a million. But the 100-plus-location operators also have the one thing that actually shortens an outage: somebody whose entire job is making the restore work. In an owner-operated practice, that job belongs to a managed services provider who bills you a few hundred dollars a month, has never once tested a full restore of your imaging server, and will be on the phone with eleven other clients the morning you call.

We've seen the gap play out in the pattern of these disclosures. The organizations that recover fast describe a contained window of days. The ones that don't describe forensic investigations that run for months before they can even tell patients what was taken. That delay is not a technical curiosity. It is the difference between one bad fortnight and a year of legal exposure.

What Most Owners Get Wrong: Treating the Cyber Rider as the Plan

The specific mistake, and it is near universal among solo and two-doctor owners who have bought a cyber endorsement on their business owner's policy: believing the insurance is the preparation. The owner reads a $50,000 or $100,000 cyber limit on a renewal declaration, feels covered, and moves on. Their IT vendor says "we back up nightly to the cloud," nobody asks what that sentence means, and the file sits closed for three years.

Two things break. First, cyber policies increasingly condition payment on controls you attested to on the application: multi-factor authentication on remote access, offline or immutable backups, endpoint detection. If the attestation was filled in optimistically by an office manager who didn't know the difference between a cloud sync and an immutable backup, you have a coverage fight on top of an outage. A cloud sync is not a backup. If ransomware encrypts the source folder, a sync faithfully encrypts the copy.

Second, the policy pays money. It does not hand your front desk a working schedule. Insurance reimburses lost income after the fact, with a waiting period, after you document it. It does nothing for you at 7:40 a.m. on day one when fourteen patients are coming and nobody can see a chart, a radiograph, a medical alert, or a planned treatment sequence. The owners who get through this well are the ones who printed something.

Ten Dark Days Runs About $177,000

Run the arithmetic on a general practice collecting $1.2 million a year across roughly 192 clinical days. That's $6,250 of production a day.

A ransomware event that takes practice management, imaging, and the schedule offline for ten business days wipes $62,500 of production off the board.

You'll recover some of it. Hygiene reschedules, crown seats slide a week, the emergency patients go elsewhere and don't come back. Call it 60% recaptured inside 90 days, which leaves $25,000 gone for good.

Meanwhile the fixed costs don't pause. With payroll, rent, equipment notes, and practice debt running $38,000 a month, two weeks of dark operations still burns $19,000.

Then the breach bill, which is the part owners never model. Say you have 4,000 patients with identifiable data in the stolen set. Mailed notification plus a year of credit monitoring at roughly $12 a head is $48,000.

Add forensic investigation and breach counsel, which for a practice-scale event runs $45,000 to $85,000; use $60,000. Add rebuilding servers and workstations from clean images at $25,000. Total, before any ransom and before a single patient lawsuit or regulatory inquiry: $177,000.

Hold that against the Bureau of Labor Statistics median annual wage for dentists, $176,110 in May 2025. One ten-day outage costs almost exactly what a dentist earns in a year. That is the line worth texting to your partner tonight.

The $9,000 Control Nobody Tries to Sell You

Here's what the recovery-first position actually costs. An immutable, versioned offsite backup of your practice management and imaging data, the kind an attacker with domain admin cannot delete, runs about $300 a month, so $3,600 a year. A quarterly full restore test, four billable hours at $150, is $2,400 a year. A printed downtime kit refreshed weekly (tomorrow's and the next day's schedule, patient contact numbers, medical alerts, paper routing slips, paper consent and perio forms, the lab case list) plus staff time to drill it twice a year is maybe $3,000. Round the program to $9,000 a year.

Against a $177,000 event, that's a 19.7x return on the one control that actually shortens the outage.

And it's cheap for a reason nobody likes: it isn't a product. There's no dashboard, no monthly threat report, no logo for the break room. A tested restore is just a boring quarterly appointment where someone proves that a full copy of your data comes back on different hardware inside a measured number of hours. If your IT vendor has never given you that number in writing, you don't have a backup. You have a receipt.

If You're Affiliating, Pull Their Registration First

For owners in a sale conversation, this summer added a diligence item that cuts the other direction. You are not just selling a practice. You are handing your patient database to someone else's security posture, and your name stays on the door when the notification letters go out.

Texas is one of the few states that gives you a place to look. Under Business and Commerce Code Chapter 73, every dental support organization operating in the state registers annually with the Secretary of State, pays a $150 fee by the January 31 renewal, and discloses any dentist or non-dentist owner holding 10% or more of the equity. That filing tells you who actually controls the organization behind the letter of intent, which is usually a fund, and often a fund you've never heard of.

Use it. Then ask the questions the LOI won't prompt: has any entity under this ownership reported a breach in the last 36 months, who owns the incident response retainer after close, does the data migration leave a copy of your records on a system you no longer control, and who pays notification costs if the event traces to a pre-close vulnerability. We wouldn't sign a letter of intent without written answers to those four. An acquirer that treats them as unreasonable has told you something about how they run IT.

Five Things to Do Before Friday

Email your IT provider one sentence this week: "In writing, what is our tested recovery time for practice management and imaging, and when was the last full restore test?" If the answer takes more than two days or contains the word "should," you have your project. Print tomorrow's and Thursday's schedules with patient phone numbers and medical alerts, put them in a binder at the front desk, and make refreshing it a Friday closing task. Then pull your cyber endorsement, read the control attestations out loud with your office manager, and fix any one you can't honestly defend.

We'll be watching two things: whether the Absolute Dental notification count moves again as forensics close out, and whether more states copy the Texas registration model, because ownership visibility is the only lever an individual owner has against a counterparty's security debt. What would change our position is evidence that practice-scale cyber policies are reliably paying business interruption claims inside 30 days. If that starts happening, insurance becomes a real substitute for speed. It isn't one yet.

The number that drives all of this is your daily fixed cost, because that's what keeps burning while the servers are dark. Most owners know their overhead as a percentage and have never converted it into dollars per closed day. Our overhead calculator does that conversion in about four minutes, and it will tell you exactly what a ten-day outage costs your specific practice: run your own numbers.