Ransomware attack exposes sensitive information of nearly 9 million dental patients

A recently disclosed ransomware attack compromised some particularly sensitive medical data. Dental insurer Managed Care of North America (MCNA) said the intruder accessed patients and took copies of patient information between February 26 and March 7, including addresses, social security numbers, driver’s licenses and insurance information. MCNA says some of the information is for parents, guardians and guarantors (people who pay bills on behalf of others). A filing provided by the Maine Attorney General indicates that more than 8.9 million people have been affected.

The company has not identified the culprit. However, TechCrunch has learned that Russia-based LockBit ransomware group is taking credit, saying it released all the files after MCNA refused to pay a $10 million ransom. Data samples of around 700 GB seem to support the claim.

MCNA offers one year of free identity theft protection to affected customers. He also advises customers to check their accounts and bills for anything unusual. The company says it is the largest U.S. government-sponsored children’s and seniors insurer, and partners with New York City and several unions.

This statistic makes this the largest health data breach so far in 2023. Prior to this, the largest data breach in March was at PharMerica, which resulted in the security breach of nearly 6 million patients. MCNA is far from a victim of ransomware, but reactions have varied across industries. While some refused to pay the ransom and instead dealt with the fallout, others paid millions to restore their systems.

This also shows that LockBit is not crippled by the recent power strike. Canadian police arrested suspected ringleader Mikhail Vasiliev in November, while the United States indicted the Russian national in March. However, the cybercriminal group has been linked to high-profile attacks involving the California Department of the Treasury and Britain’s Royal Mail. It is unlikely that such campaigns will stop in the near future.