It is 7:20 on a Tuesday morning. The front desk logs in and Dentrix won’t open. The server shows a text file on the desktop instead of a login screen. The first patient is at 8:00, there are fourteen more behind them, and the phone is already ringing. This is what a dental office ransomware event actually looks like — not the headline, the Tuesday. Here is what happens in the first 72 hours, what the practice has to decide, and the design choices made months earlier that determine whether this is a closed practice or a long day.
Dental offices are a favored target. They hold a database of names, dates of birth, Social Security numbers and insurance IDs; they run on a single server that is often years old; and they depend on that server so completely that downtime costs thousands of dollars an hour. Attackers know all three things.
Hour 0–2: the discovery, and the mistakes made in the first ten minutes
The first instinct is to fix it — reboot the server, run the antivirus, call whoever set it up. The first instinct is wrong. Ransomware is not a malfunction; it is an intrusion that is usually still in progress. What to do in the first two hours:
- Disconnect, don’t power off. Pull the network cable from the affected server and workstations, or shut the switch port. Do not power the machines down — memory contains evidence that forensics will need, and some strains encrypt further on reboot.
- Do not touch the ransom note beyond photographing it. The note tells you the strain, and the strain tells the responders what they are dealing with. Do not contact the attacker.
- Stop backups from running. A scheduled backup that fires now will copy encrypted files over your last good set, if it can reach them. This is the moment an immutable off-site backup earns its keep — the attacker cannot delete it and neither can a well-meaning backup job.
- Call your IT provider and your cyber-insurance carrier, in that order, within the hour. Most cyber policies require notice within 24–72 hours and many require you to use their approved incident-response firm. Calling the wrong forensics company can void coverage.
- Go to emergency mode. Printed schedule, paper charting, standalone card terminal. If the practice has an emergency mode operation plan, this is when the team opens it. If it does not, this is when they wish they did.
Decide early whether to see patients today. Most practices can, on paper, for hygiene and simple restorative. Anything imaging-dependent gets rescheduled unless sensors can capture locally.
Hour 2–12: scoping — how bad is it?
The incident-response team (your IT provider, the insurer’s firm, or both) works three questions in parallel:
- What is encrypted? The PMS server, obviously. But also: imaging server, file shares, workstations, the NAS in the closet, the backup drive plugged into the server. Every device is checked.
- How did they get in, and are they still in? The common dental entry points are a phished front-desk email account, a remote-access tool (the one the old IT guy left open), an unpatched firewall, or a compromised vendor. Until the entry point is found and closed, restoring is pointless — they come back.
- Was data taken, not just encrypted? Modern ransomware crews exfiltrate first, then encrypt, then threaten to publish. Whether ePHI left the building is the question that determines everything about the next 60 days, because it decides whether this is a HIPAA breach.
This is also when the practice finds out what its backups really are. If the last restorable copy is nightly and off-site and immutable, the recovery point is yesterday evening. If the backup drive was attached to the server, it is encrypted too, and the recovery point is whenever someone last took a copy home — which is often never.
Hour 12–36: the decision — restore, or pay
With scope known, the practice faces the decision the whole event has been building toward.
If a clean, restorable backup exists, the answer is restore. The environment is rebuilt from known-good media — not cleaned, rebuilt — the entry point is closed, credentials are reset everywhere, and data is restored from the last good copy. For a single-location practice with a tested backup and a documented disaster recovery plan, this is a one-to-three-day outage. Charting done on paper during the outage is entered afterward.
If no usable backup exists, the practice is choosing between losing its patient records and paying a criminal group. Paying is legal in most cases but carries real problems: no guarantee of a working decryptor, possible sanctions exposure depending on the crew, a target painted on the practice for repeat attacks, and — critically — paying does not undo the breach if data was exfiltrated. Practices that pay still have to notify. Insurers increasingly resist paying. This is not a decision to make alone; it is made with counsel and the insurer.
The gap between these two paths is the entire argument for backup design. Nothing else in dental IT has this much leverage.
Hour 36–72: rebuilding, and the HIPAA clock starts
The rebuild. Server reimaged or replaced. Workstations reimaged — not scanned, reimaged. Firewall rules reviewed. Every password in the practice changed, including the PMS vendor’s support account and the imaging software’s service account. MFA enforced on email and remote access if it wasn’t already; see the MFA deployment guide for dental practices. Endpoint detection and response deployed on every machine before it reconnects, so the same strain cannot walk back in.
The data. PMS database restored and validated: patient count, today’s schedule, ledger totals. Imaging restored and the bridge to the chart re-tested. Integrations reconnected. Paper charting from the outage entered.
The notification clock. If the forensic finding is that patient data was accessed or exfiltrated, the practice has a breach, and this part is run by the insurer’s breach counsel — not by IT. Under the Breach Notification Rule, affected individuals must be notified without unreasonable delay and no later than 60 days from discovery; HHS is notified within 60 days for breaches of 500 or more (annually for smaller ones); and breaches of 500+ in a state require notice to prominent media. State laws — Kentucky, Tennessee, Ohio, Indiana and others — add their own timelines and attorney-general notifications, and a practice with patients across a state line owes both. The practice’s job is to preserve the forensic record and not make statements that become part of it; the counsel’s job is the law.
Even if data was not exfiltrated, a ransomware event is presumed to be a breach unless the practice can demonstrate a low probability of compromise through a documented risk assessment. That documentation is the deliverable of the forensic engagement.
What the practice pays, even when it goes well
Most dental ransomware costs are not the ransom. They are the two to five days of cancelled production, the incident-response engagement, the rebuilt hardware, breach counsel, notification and credit-monitoring costs if data left, the HHS investigation if it reaches 500 patients, and the staff hours spent re-entering paper charts and calling patients. Our HIPAA breach cost calculator puts numbers on it for a practice your size. The pattern is consistent: a practice with immutable backups and EDR spends a fraction of what a practice without them spends, and keeps its records either way.
The design that makes this a bad day instead of a closed practice
Everything above is decided before the Tuesday. The controls, in order of how much they matter:
- Immutable, off-site, tested backups of the PMS database, imaging and documents — a copy the attacker cannot reach, restored on a schedule to prove it works. This single control determines whether “restore” is an option.
- Endpoint detection and response on every workstation and server, monitored around the clock, with automated isolation. Modern EDR stops most ransomware at the first encrypted file and rolls it back. Antivirus does not.
- MFA on email and every remote access path. A phished password with MFA behind it is a failed login. Without it, it is the front door.
- Network segmentation — PMS server, imaging, front desk and guest WiFi on separate segments, so a compromised front-desk PC cannot reach the database directly.
- No orphaned remote access. Every remote tool inventoried, every one not in use removed. The old IT provider’s access revoked the day the relationship ends.
- Patched firewall and servers, on a schedule, with the record kept.
- A written emergency mode plan the team has walked through once.
- Security awareness for the front desk, because that is where most dental intrusions begin.
None of this is exotic. It is the baseline a dental-specialist managed IT provider puts in place on every account, and it is the difference between the two versions of the Tuesday.
Frequently asked questions
Should a dental practice ever pay the ransom?
It is a last resort made with counsel and the insurer, not a first move. Payment does not guarantee recovery, does not undo a data breach, may raise sanctions issues depending on the attacker, and marks the practice for repeat attacks. A tested, immutable backup is what makes the question unnecessary.
Is a ransomware attack automatically a HIPAA breach?
HHS guidance treats ransomware that encrypts ePHI as a presumed breach unless the practice can document a low probability that the data was compromised. That determination comes from a forensic investigation, not an assumption.
How long is a dental office typically down?
With tested backups and a documented recovery plan, one to three days for a single location. Without them, one to three weeks is common, and some practices never recover their full records.
Does cyber insurance cover this?
Usually, within limits and conditions — prompt notice, use of approved responders, and increasingly, proof that controls such as MFA, EDR and offline backups were in place when the policy was bound. A claim can be reduced or denied if the application said MFA was on and it wasn’t.
What is the very first call to make?
Your IT provider, then your cyber-insurance carrier’s incident hotline, within the first hour. Not the attacker, not a random data-recovery company from a search result.
If you want the Tuesday to be boring
ClearMax builds the controls above as the baseline of dental managed IT — immutable backups with quarterly restore tests, 24/7-monitored EDR, MFA, segmentation, and the written plans — and runs the response if the day ever comes. Start at Dental IT Support, see dental ransomware protection or dental cybersecurity in Houston for the market-level detail, or call (833) 306-3168. If something is happening right now, call that number first.