Great Expressions Data Breach: What It Means for DSOs

One break-in in 2023. Nearly two million people affected.

The Great Expressions data breach affected 1,925,397 people in a single incident at one DSO, and that is exactly what makes it worth studying. Great Expressions Dental Centers is a dental support organization that, at the time of the breach, ran around 246 practices across nine states. An unauthorized party accessed some of its systems between February 17 and 22, 2023. For any DSO, centralization is a double edge, and understanding it is the difference between scaling safely and building a single point of failure.

What happened in the Great Expressions breach

According to its notice to patients, Great Expressions experienced an event that disrupted some of its IT systems on February 22, 2023, and determined that an unauthorized party accessed some of its systems between February 17 and 22. The notice says some patient information may have been accessed or removed, and that its electronic medical records system was not affected. The organization began notifying affected individuals in May 2023, and reported the incident to federal regulators as a hacking event affecting 1,925,397 people.

The information involved varied by person. The federal breach report summary lists names, addresses, dates of birth, Social Security numbers, health insurance information, and financial and treatment information, and the notice letter says potentially affected information may have included diagnoses, prescriptions, and x-ray images. Great Expressions later settled a class action for $2.7 million in the U.S. District Court for the Eastern District of Michigan. The primary sources do not disclose how the attackers first got in, so the exact entry point is not public.

Why centralization is a strength and a target

Here is the part every DSO leader needs to sit with. The entire operational case for a dental support organization is centralization. One platform, one set of standards, one team supporting many locations. That is what makes a DSO efficient. It is also what makes it a bigger prize. The same centralized systems that let a group run hundreds of practices from a shared backbone mean that a single successful intrusion can expose patients across many practices at once.

A solo practice that gets breached exposes one office. A DSO that gets breached can expose patients across the whole group. Risk does not add up across your locations, it concentrates into the shared systems that hold everything. That concentration is the whole lesson: when hundreds of practices feed one backbone, that backbone is the crown jewel, and it has to be defended like one.

What DSOs and multi-location groups should do now

You cannot un-centralize a DSO, and you should not want to. But you can limit what any one compromised device or account can reach. These are the controls that do it:

• Segment so one compromised location cannot reach the others. Centralized does not have to mean flat. If breaching one practice’s machine opens a path to every other location, the network is one flat target wearing a DSO’s name. Access boundaries between locations limit how far any one compromise can spread.
• Guard the shared backbone like the crown jewel it is. The systems that let you run many practices from one platform hold everyone’s data at once, so they deserve stronger controls than any single location would get on its own. The more a system aggregates, the more monitoring and access restriction it has earned.
• Enforce one security baseline, not per-location drift. Many groups standardize scheduling and billing but let each office’s security run on its own habits. One enforced baseline across every practice closes the weak-link problem where the least-protected location becomes the way into the whole group.
• Do not let every location’s most sensitive data pool in one reachable place. For your group, limit how much Social Security, financial, and treatment information any one system or account can reach. Separating and archiving the most sensitive fields means one compromised system does not hand over everything the group has ever collected.

Scale multiplies the damage

The lesson is not limited to one company or one size of group. You can see how much patient data a single organization can hold across the biggest dental data breaches on record, from incidents at benefits administrators like the DentaQuest breach to DSO incidents that reach patients of many practices at once. When a group centralizes patient information, its defenses have to match how much those shared systems hold.

For your group, treat security as core infrastructure, the same way you treat the practice management system every location depends on. A shared backbone without segmentation is a shared liability. The protection that matches the scale is one baseline across every location, active monitoring on the systems that hold the most, and architecture that limits what any one compromised system can reach.

That is the work we do for the dental groups and DSOs we protect at Medix Dental IT. We build one enterprise-grade security baseline across every location, monitor the shared systems that hold the most data, and design segmentation so one compromised device or account cannot reach everything. If an attacker got into one of your locations tonight, how many of the others could they reach? A cybersecurity assessment gives you the real answer. Prevention is always cheaper than panic.

Posted in Dental Cybersecurity, News