Cyber Incident Victim: White and Bright Family Dental
Date:
Jan 2018
Location:
United States of America
Summary
A Fresno dental practice experienced unauthorized access to a server containing patients' protected health information, including names, addresses, Social Security numbers, driver's license details, insurance data, and dental records. The breach prompted immediate law enforcement notification and an active police investigation, though the extent of data exfiltration and attackers' motives remain unclear. The practice enhanced security protocols and notified affected individuals while coordinating with relevant government agencies. Patients were advised to monitor financial and health statements for irregularities and offered contact information for credit reporting agencies to mitigate potential identity theft risks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 30, 2018, cyber criminals gained unauthorized access to a business computer server containing protected health information at White and Bright Family Dental in Fresno. The dental practice immediately notified the Fresno Police Department on the same day to initiate identification and prosecution efforts, resulting in police report number 18300943. The compromised server stored extensive patient data including full names, addresses, telephone numbers, Social Security numbers, dates of birth, driver's license numbers, insurance details, and complete dental treatment histories. While the practice confirmed unauthorized access occurred, they stated they had no evidence confirming whether data was copied or stolen, nor could they determine the attackers' specific intentions regarding the accessed information. The incident remained under active investigation by both law enforcement and the dental practice at the time of patient notifications.
White and Bright Family Dental began notifying affected patients through letters dated February 16, 2018, advising them to review financial and health insurance statements for discrepancies. The practice implemented heightened security measures to prevent recurrence but provided no specific technical details about these enhancements. Patients were instructed to reference police report number 18300943 when disputing fraudulent charges and directed to contact major credit bureaus—Equifax, Experian, and TransUnion—to place fraud alerts. The notification included contact information for filing complaints directly with the practice, as well as with the Department of Health and Human Services Office for Civil Rights. The dental practice formally apologized to patients while emphasizing their ongoing cooperation with law enforcement and compliance with mandatory government agency notifications.