Why Ransomware Targets Dental and Medical Practices

Ransomware attacks on healthcare organisations make headlines regularly. But the coverage usually focuses on large hospitals. The reality is that small and medium-sized dental and medical practices are targeted just as frequently — and often more successfully — because they're seen as easier targets with fewer defences.

Understanding why your practice is attractive to attackers is the first step toward doing something about it.

What is ransomware?

Ransomware is a type of malware that encrypts files on a device or network, making them inaccessible. The attacker then demands payment — usually in cryptocurrency — in exchange for the decryption key. In recent years, attackers have added a second layer of pressure: threatening to publish or sell stolen data if the ransom isn't paid.

For a dental or medical practice, this means patient records, clinical notes, billing data, imaging files — everything — could be locked or leaked.

Why healthcare practices are targeted

High-value data

Patient health information is worth significantly more on criminal marketplaces than basic financial data. A patient record containing Medicare numbers, health conditions, prescriptions, and contact details can sell for many times the value of a credit card number. That makes healthcare data particularly attractive to steal and monetise.

Pressure to pay

A practice that can't access its systems can't operate. Patient bookings, clinical records, prescriptions, and billing are all inaccessible. The downtime pressure — combined with obligations around patient care — creates a strong incentive to pay the ransom quickly rather than wait out a lengthy recovery process. Attackers know this and price their demands accordingly.

Under-resourced security

Most practices don't have a dedicated IT or security team. Systems are often managed by a part-time IT contractor or by staff who picked up the role incidentally. That creates gaps: unpatched software, weak passwords, no MFA, inadequate backups. Attackers specifically scan for these gaps before launching an attack.

Connected systems and devices

Practices run multiple connected systems — patient management software, imaging equipment, billing platforms, Microsoft 365. Each integration is a potential entry point. A compromise of one system can quickly spread to others on the same network.

Regulatory obligations create additional leverage

Under the Privacy Act and the Notifiable Data Breaches scheme, practices have legal obligations when patient data is compromised. Attackers use this as leverage — threatening to report the breach themselves if you don't pay. The reputational damage of a publicly disclosed breach adds further pressure.

How ransomware gets in

The most common entry points are:

• Phishing emails — a staff member clicks a malicious link or opens an infected attachment
• Compromised credentials — attackers use stolen usernames and passwords (often from data breaches on other sites) to log in to your systems
• Unpatched software — known vulnerabilities in outdated software are exploited before you've had a chance to apply the fix
• Remote Desktop Protocol (RDP) — if remote access is exposed to the internet without proper controls, attackers can brute-force their way in

What reduces your risk

You don't need to be perfectly secure — you need to be harder to attack than the next practice. Most ransomware attacks are opportunistic. Attackers target the easiest path. Closing the obvious gaps significantly reduces your exposure.

• Multi-factor authentication (MFA) on all accounts — stops credential-based attacks even if passwords are stolen
• Regular, tested backups stored offline or in an isolated cloud environment — your recovery option if you do get hit
• Patch management — keeping operating systems and software up to date removes known vulnerabilities
• Email filtering — blocking malicious links and attachments before they reach staff inboxes
• Endpoint protection — modern antivirus/EDR software that detects ransomware behaviour before encryption completes
• Staff awareness training — your team is the last line of defence against phishing

What to do if you're hit

If you suspect a ransomware attack is underway or has already occurred:

1. Disconnect affected devices from the network immediately — this limits spread
2. Contact your IT or security provider — do not attempt to pay or negotiate without advice
3. Preserve evidence — don't wipe devices before a forensic review
4. Assess whether you have a backup you can restore from
5. Consider your notification obligations under the Notifiable Data Breaches scheme

Paying the ransom does not guarantee you'll get your data back — and it funds future attacks. Recovery from a good backup is always the preferred outcome.