9M Dental Patients Affected by LockBit Attack on MCNA

The government-sponsored dental and oral healthcare provider warned its customers that a March attack exposed sensitive data, some of which was leaked online by the ransomware group.

Image shows a couputer terminal with "crime scene" yellow tape around it, a lamp and a plant on an office desk;
Source: Andreas Prott via Alamy Stock Photo

A US government-sponsored provider of dental healthcare is warning nearly 9 million clients that their sensitive and private personal and medical data was exposed in a LockBit ransomware attack that occurred earlier this year.

Managed Care of North America (MCNA) Dental — which works with various Medicaid agencies, the Children's Health Insurance Programs, corporations, and insurance plans — put out a notice on May 26, before the Memorial Day weekend, that a cyberattack that occurred between Feb. 26 and March 7 successfully lifted sensitive data from its computer systems.

The breach affected more than 8.9 million clients of MCNA, according to a data breach notification filed with the Maine Attorney General. The Atlanta-based healthcare organization is one of the country's largest providers of government-sponsored dental care and oral health in the US.

"On March 6, 2023, MCNA became aware of certain activity in our computer system that happened without our permission," the company said in the post on its website. "We quickly took steps to stop that activity."

Those steps were not quick enough to stop LockBit ransomware — which took responsibility for the attack — to make good on a threat to leak 700GB of data stolen from MCNA's systems if the provider did not pay $10 million in ransom. On April 7, the group released all of the data on its website for anyone to download, according to reports.

Dental Leak Included Sensitive Data

Included in that stolen data was a slew of personally identifiable information (PII) about MCNA clients — which may in some cases be for a parent, guardian, or guarantor of someone receiving service through the agency, the company said. This data included patient names, addresses, dates of birth, phone numbers, email addresses, Social Security numbers, and driver's licenses or other government-issued ID numbers, according to MCNA.

Data leaked in the attack also included details about clients' health insurance — including plan information, insurance company, member number, Medicaid-Medicare ID numbers, and what type of care they received from their provider. Attackers also stole bill and insurance claim info in the breach, according to MCNA.

"We are sorry for any concern this event may cause," the company said in the notice, adding that it will mail letters separately to people whose information "may have been involved" in the breach. The notice will remain active for 90 days to inform clients whose addresses that MCNA does not have and thus cannot be informed through the mail, it added.

MCNA also is offering clients affected by the breach an identity theft protection service for one year, and encouraged people to contact them via a toll-free number with any questions or concerns.

LockBit Strikes Again

LockBit, a ransomware-for-hire group that emerged as early as September 2019, is one of the more prolific ransomware gangs currently active on the scene. The group has made a name for itself by targeting high-profile victims — such as SpaceX and security giant Entrust — with its style of double-extortion ransomware, using auto-propagating malware and double-encryption methods that show a level of sophistication.

LockBit may have suffered a setback when one of its alleged leaders, dual Russian-Canadian citizen Mikhail Vasiliev, was arrested in Ontario, Canada, in November, but it hasn't stopped the gang from launching a slew of attacks since then, leaking data from its victims along the way.

While the advice security experts traditionally gave to organizations that are victims of ransomware was not to pay attackers, double-extortion attacks that result in data leaks that can harm both companies and their clients in the long run have changed the rules of the game. Some experts now advise considering various factors before deciding whether or not to pay a ransom, and that in some cases it might benefit them more in the long run to give in to attackers' demands.

Organizations can protect themselves against ransomware attacks by shoring up their overall security defense posture in myriad ways, including implementing secure passwords and multifactor authentication (MFA), so systems aren't breached in the first place. They should also put up strong controls to defend against phishing attacks, as attackers often use credentials stolen in this way to gain initial access to a network to deploy ransomware, experts said.

About the Author(s)

Elizabeth Montalbano, Contributing Writer

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights