MCNA Dental Data Breach: What It Means for Dental Practices

Nine million people is not a rounding error. It is a warning about how these attacks actually work.

The MCNA Dental data breach exposed the personal and health information of 8,923,662 people, making it one of the largest breaches in the history of the dental sector. MCNA is not a dental practice. It is one of the largest administrators of government-sponsored Medicaid and CHIP dental benefits in the country, holding identity data for millions of patients, many of them children, in one place. When a ransomware crew got in, eight days passed before MCNA discovered the intrusion, and the attackers were able to see and take copies of patient data. That gap between getting in and getting caught is the whole story, and it is the part every dental practice and DSO should learn from.

What happened in the MCNA Dental breach

According to reporting from TechCrunch, the LockBit ransomware gang gained access to MCNA’s network on February 26, 2023. The intrusion was not discovered until March 6, eight days later. In that window, the attackers reached a large store of patient data and exfiltrated it. LockBit later claimed on its leak site to have taken around 700GB of data and demanded a $10 million ransom.

LockBit says MCNA refused to pay. On April 7, 2023, the gang posted the stolen data on its leak site, BleepingComputer reported. The company finished reviewing what data was affected in early May and began notifying the 8,923,662 affected individuals, along with their parents, guardians, and guarantors, at the end of that month. The exposed data was a full identity-theft kit: names, addresses, dates of birth, phone numbers, email addresses, Social Security numbers, driver’s license and government ID numbers, Medicaid and Medicare ID numbers, health insurance details, and dental treatment records. Healthplex, Inc. was later named as a co-defendant in the class action that followed. It stands as one of the largest healthcare breaches disclosed in 2023.

That class action has since reached a settlement. On July 14, 2026, the federal court in Fort Lauderdale granted preliminary approval and scheduled a final approval hearing for November 16, 2026. The deadline for class members to file a claim, opt out, or object passed on October 19, 2026. Preliminary approval is not final approval, so check the official MCNA settlement website for the current status before answering a patient, and point them there rather than to a link in an email.

Why dwell time is the number that matters

Here is the detail most of the coverage skips past. MCNA became aware of the activity eight days after the attackers first got in. Security teams call that dwell time, the stretch between initial access and detection, and it is where breaches are won or lost. Getting in does not by itself leak nine million records. Undetected time gives an intruder room to map a network, find sensitive data, and copy it out.

If LockBit’s claim of roughly 700GB is anywhere near accurate, that is a lot of data to move. On your own network, outbound volume on that scale is exactly what monitoring should flag. The uncomfortable truth is that most dental organizations have no system watching for this at all. They have antivirus on the endpoints and a firewall at the edge, and they assume that is a security program. It is not. Neither of those tools is designed to flag an attacker who is already inside, using valid credentials, slowly draining a database.

What dental practices and DSOs should do now

You cannot fix MCNA’s network. But you can make sure your own organization shrinks dwell time from weeks to hours, so a single foothold never becomes a nine-million-record headline. Four moves do most of the work:

• Put detection on every endpoint, not just antivirus. Endpoint detection and response watches for what an intruder does after they are already in, lateral movement between machines, privilege escalation, and unusual bulk transfers. That is what can turn days of silence into a same-day alert. Antivirus looks for known malware and misses an attacker using a valid login entirely.
• Alarm on bulk data leaving the network. Large, unexpected outbound transfers are a warning sign worth alarming on. LockBit claimed it took about 700GB from MCNA. Alerting on abnormal outbound volume is one of the cheapest ways to catch exfiltration while it is happening instead of reading about it on a leak site.
• Have someone actually watching the alerts. Detection tools only shrink dwell time if a human or a monitored service responds when they fire. A tool nobody is watching produces a report after the breach, not a stop during it. This is the gap most dental organizations do not know they have until it is too late.
• Rehearse how fast you can respond. Speed after detection is the other half of dwell time. Know in advance who isolates a compromised machine, who cuts off the account, and how quickly, so the window between the first alert and containment is measured in minutes rather than days.

Detection is the control that matters most

MCNA is a large administrator, but the lesson carries across dentistry, from the biggest dental data breaches on record, such as the DentaQuest extortion breach, to the everyday attacks that never make headlines. In the practices we protect, a common pattern is an attacker using a trusted login, then working undetected because nothing is watching. For a DSO that undetected foothold is worse, because it can spread across locations and centralized systems.

The question to ask is not “do we own security tools.” It is “would anyone here notice an intruder on day three.” Antivirus and a firewall do not answer that question. Detection does.

That is the work we do for the dental groups and DSOs we protect at Medix Dental IT. We put detection on every endpoint, monitor for the lateral movement and data exfiltration that turn a foothold into a catastrophe, and keep dwell time measured in hours instead of weeks. If you have ever wondered how long an intruder could move inside your network before anyone noticed, that is the number a cybersecurity assessment answers. Better to learn it from us than from a leak site.

Posted in Dental Cybersecurity, News