Dental Care Alliance dentalcarealliance.com Dental Care Alliance data breach: what happened and what to do
Dental Care Alliance, which supports dental practices, reported a ransomware attack to HHS that affected 1,723,375 people. The intrusion began September 18, 2020. Data included names, addresses, dental treatment and billing information and health insurance details. Letters first went out in November 2020.
View all 13,177 breaches- Breach date
- 18 Sept 2020
- Made public
- 8 Dec 2020
- Affected
- 1,723,375
- Data exposed
- Names, Physical addresses, Treatment information, Health insurance information, Bank account numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Dental Care Alliance (DCA) provides support services to dental practices across the US. Reporting based on its notices says an intruder got into its systems on September 18, 2020, DCA found the attack on October 11 and contained it by October 13.
The count grew over time. DCA's first report to the US Department of Health and Human Services (HHS) listed 1,004,304 people. The HHS breach portal now shows 1,723,375, and HHS's description calls it a ransomware attack on a business associate. DCA's own letters didn't spell out the type of attack.
Sources checked: ocrportal.hhs.gov, bankinfosecurity.com, hipaajournal.com
Last verified against the official page:
What was exposed
HHS says the data included names, addresses, clinical information, financial information and other treatment information. HIPAA Journal reports it also covered dental diagnosis and treatment details, account and billing data and health insurance information, with bank account numbers affecting only a small share of people.
Dental and insurance details let scammers pose as your dentist or insurer in a believable call or text. If an account number was involved, fake billing messages are the likeliest abuse.
The company's response
According to HHS, DCA notified affected people and the media, added administrative and technical safeguards and retrained employees. Coverage at the time said it didn't appear to offer credit monitoring.
What to do if you were in it
- 1
Treat billing and appointment messages with care
Expect texts, calls and emails that mention your dentist, a bill or your insurance. Don't click links in them; contact the practice on a number you look up yourself.
- 2
Read your insurance statements
Check explanation of benefits statements from your insurer and question any treatment or bill you don't recognize. The FTC lists medical identity theft warning signs.
- 3
Watch your bank account
If your letter says a bank account number was involved, review statements for charges you don't recognize and ask your bank about extra protection.
- 4
Check your credit reports and statements
Review your reports for free at annualcreditreport.com and read bank statements for charges you don't recognize. If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 5
Freeze your credit at all three bureaus
A credit freeze is free and stops lenders from seeing your credit report, which blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Worth doing if your letter lists anything beyond names and treatment details.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus keeps watching and alerts you if they turn up in a new leak.
Official filings
- U.S. Department of Health and Human Services , filed 8 Dec 2020 : 1,723,375 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Dental Care Alliance data breach?
If you were a patient of a dental practice DCA supports, you may have received a letter in late 2020. HHS lists 1,723,375 people affected in total.
What was exposed?
Names, addresses, clinical and treatment information, financial and billing information, and for some people health insurance details.
Was it a ransomware attack?
HHS's description says so. DCA's letters didn't spell out the type of attack.
Do I need a credit freeze?
The notices don't list Social Security numbers, so it's optional here. It's free, so many people place one anyway.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- bankinfosecurity.com/vendor-to-dental-practices-hacked-1-million-affected-a-15566
- hipaajournal.com/dental-care-alliance-data-breach-impacts-more-than-1-million-patients/
- identitytheft.gov/databreach
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- annualcreditreport.com
- consumer.ftc.gov/articles/medical-identity-theft
Something wrong or out of date? Tell us and we'll re-check it.
