Your patient data is worth $250/record on the dark web

A complete patient record sells for up to $250 on criminal markets, roughly 46 times the $5.40 that a stolen payment card brings, according to Trustwave data cited by Imprivata. Your front desk login, the one three people share, sells for $50. That spread is the entire business model of the people trying to get into your practice management software this quarter.

Here's the claim an informed owner can argue with: the $250 record price is the least useful number in this conversation. The number that should ruin your week is $10 to $50, because that's what a criminal pays for a working set of healthcare VPN or EHR credentials on an infostealer market, per Breachsense, and once they have that, your charts cost them nothing. Our view: dental cybersecurity is a credential problem wearing a compliance costume, and almost every dollar the average practice spends on it is spent in the wrong place.

$250 Is the Resale Price, Not Your Loss

Start with the market, because the market is unusually well documented for something this illegal. HIPAA Vault puts a single medical record at $250 to $1,000 on dark web markets against stolen credit cards that rarely clear $5. Breachsense prices complete medical records at $250 to $500, 10 to 100 times a card number.

Why the premium? A card number has a short shelf life. The bank cancels it, the fraud resolves, everyone moves on. A patient record does not expire. It carries a name, a date of birth, a Social Security number, an address history, an insurance ID, a treatment history, and often a scanned driver's license and a stored payment method. You can open credit with it, bill a government payer with it, impersonate the patient at a pharmacy with it, or extort the patient directly with the clinical details. Nobody cancels a date of birth.

Dental practices sit in the sweet spot of this market. You hold the same identity data a hospital holds, you hold it on fewer and softer systems, and you have no security staff. The record is worth hospital money. The door costs vending machine money.

The $50 Login Is the Real Product

Most owners picture a breach as a hacker defeating something. That's not what happens. What happens is that someone on your team installs a cracked PDF tool or clicks a fake e-claims attachment, an infostealer scrapes every saved password out of the browser, and the resulting log file, which includes your cloud PMS login and your clearinghouse portal and your bank, gets bundled and sold for the price of a decent lunch. Breachsense tracks those healthcare credential logs at $10 to $50.

That price is the single most important fact in this article. It means the attacker's cost of entry into your practice has nothing to do with the value of what's inside. It also means the attack doesn't require anyone to target you. Logs get harvested in bulk, sorted by keyword, and resold to people who specialize in healthcare extortion. Nobody woke up and chose your four-operatory practice in a town of 18,000. Your credentials just showed up in a batch, tagged as dental.

Which is why "we're too small to be interesting" is not a security posture. It's a misunderstanding of who's shopping.

Ten Dark Days in a $957,588 Practice

Let's price the event rather than the data. Take a practice collecting $957,588, the median among the 925 practices currently listed for sale in the Practice Market Index, our own dataset built from broker listings (n=753 for collections). That's the asking side of the market, not a typical practice, but it's a clean, real number to work from, and those listings run a median 5 operatories (n=754).

Spread $957,588 across 225 clinical days and the practice produces about $4,256 a day. A ransomware event that locks your schedule, your charts, and your imaging for ten working days puts $42,560 of production on the floor. Be generous and assume you claw half of it back with Saturdays and double-booked columns over the following quarter, so call the permanent production loss $21,280.

Now the payroll you keep paying for people who can't work. BLS puts the median dental hygienist wage at $47.16 an hour as of May 2025, so two hygienists idle for eight hours across ten days costs $7,545.60 in wages against zero production. Your own time is the quiet one. BLS puts the median dentist wage at $84.67 an hour, $176,110 a year, and forty hours of your attention spent on forensics calls, insurance adjusters, and a notification letter is $3,386.80 of dentistry you will never do.

Then the costs we won't pretend to source for you, because they're quotes, not statistics. Price them with your own carrier and your own counsel rather than taking our placeholders. Assume forensics and rebuilding endpoints runs $35,000, breach counsel runs $15,000, and notification plus credit monitoring for 7,500 charts in the system runs $8 a head, or $60,000. Add it up: $142,212.

Against that, the controls that actually stop the credential path. Phishing-resistant hardware keys at roughly $30 each for twelve people is $360 one time. Managed endpoint detection at $8 per device per month across fifteen devices is $1,440 a year. Call it $1,800 in year one. That's 0.19% of collections. The scenario above is 79 times that spend.

You do not need to believe a breach is likely for that trade to be obvious. You only need to believe it's possible once in a career.

What Owners Get Wrong: The Binder Is Not a Control

The specific mistake, and it's concentrated among one- and two-location owners who outsource IT to a local managed services provider on a break-fix retainer, is this: they buy a HIPAA compliance package, complete the risk assessment, file the binder, and believe they've bought security. They haven't. They've bought documentation of the condition they were already in.

The giveaways show up in the same three places every time. One shared front desk login, because it's faster at check-in and because the schedule has to be open before the first patient walks in. The same password on the practice email, the clearinghouse, and the owner's personal Amazon account. And remote access left standing from the pandemic so the billing contractor can get into the server from home, with a password and nothing else in front of it.

Each of those is the thing the $50 log sells. None of them is improved by another annual attestation. Our position is blunt: we'd stop paying for compliance theater and move that same money to identity. If your IT vendor's security plan does not start with phishing-resistant multi-factor authentication on email and on your practice management system, and does not end with offline, tested backups, you're paying for a binder.

We'd also drop the cyber policy that covers forensics and notification but sublimits business interruption to something like $25,000. The production loss is the biggest line in the scenario above and the one most owners discover is barely covered, on the phone, on day three.

Why This Shows Up When You Sell

Here's the part that doesn't feel like a security conversation. Among listings in the Practice Market Index, each operatory carries a median $200,000 of annual collections (n=643), which tells you how concentrated the production is and how little redundancy the average operation has. When a buyer's attorney runs diligence, an unresolved breach or an incident you handled quietly and never reported stops being an IT footnote and starts being a representation you have to make in writing, backed by an indemnity.

We've seen enough deal structures to say this plainly: as a buyer, we wouldn't close on a practice with an open regulatory matter without an escrow holdback and a survival period long enough to cover the tail. As a seller, that holdback is your money sitting in someone else's account for eighteen months. The cheapest time to fix your identity controls is years before anyone reads your reps and warranties.

The Four Things We'd Buy First

Order matters more than budget here. We'd do these in sequence and stop spending on anything else until all four are done.

• Hardware security keys or app-based phishing-resistant MFA on practice email and the practice management system, for every user, with the shared front desk account deleted and replaced by named logins.
• A password manager with enforced unique credentials, so one stealer log does not open five doors.
• Backups that are offline or immutable, restored from in a live test you personally watched, with the restore time written down.
• A written answer to one question: who do we call in the first hour? Name, number, retainer status. Not a vendor category.

Everything else, the awareness posters, the annual quiz, the firewall upgrade, is downstream of those four. A criminal can buy the keys to your entire patient base for less than you spend on a box of gloves, and no amount of training makes that spread go away. Closing the door does.

Do This Before Friday

Pull a list of every account that can see patient data, including the ones belonging to people who left, and delete the shared logins today. Turn on multi-factor authentication for the practice email and the PMS before you turn it on anywhere else, and have your office manager watch you do it so it survives your vacation. Then call your insurance broker and ask for the business interruption limit and the waiting period on your cyber policy, in writing, not the summary page. If the waiting period is longer than 24 hours, you're uninsured for the most likely version of this event.

We're watching two things from here. First, whether healthcare credential logs keep falling below the $10 floor, because commoditized access means volume, and volume means practices get hit without ever being chosen. Second, whether the cloud PMS vendors make phishing-resistant MFA mandatory rather than optional. If they do, the credential market for dental dries up and the attack moves one layer up to the vendors themselves, where one breach reaches thousands of practices at once. That would change our advice completely, and it would make your vendor's security posture the single most important thing on your due diligence list. It isn't there yet.

If you want to see what ten dark days would actually cost your practice rather than the median listing we used above, start with your own production per day and your own chart count. Our free valuation calculator will put a real number on the asset you're protecting and the production base a breach would interrupt, and it takes about four minutes. Run your own numbers, then go set up the MFA.