Dental office ransomware: what to do in the first 24 hours

If a ransom note appears on a screen in your office, the next few hours decide how much you lose and how much evidence survives. This guide covers the first day, step by step, based on what CISA, the FBI and HHS publish, and the HIPAA notification rules that start running from discovery.

The first hour: isolate, do not power off

CISA’s #StopRansomware Guide says to find the affected systems and isolate them right away. If several machines are hit, take the network offline at the switch. If you cannot, unplug the network cable from each affected computer or take it off the Wi-Fi.

CISA lists powering devices down as a fallback, only for when you cannot disconnect them. Shutting down wipes evidence held in memory. So pull the cable, leave the machine on, and do not restart it.

HHS’s ransomware fact sheet says the same thing in HIPAA terms: activate your security incident response plan and isolate the infected systems to stop the spread.

Call by phone, not email

CISA notes that attackers may watch your email and messages to see whether they have been spotted. Use phone calls to coordinate. Call these people in this order:

1. Your IT provider.
2. Your cyber insurance carrier, if you have a policy. Many policies have their own claim steps and approved responders, so read yours.
3. Your compliance adviser or attorney, because the HIPAA clock may already be running (see below).

Do not pay, and do not talk to the attackers, without advice

The FBI’s IC3 ransomware page says the FBI does not support paying a ransom, and that paying does not guarantee you will get any data back. Do not reply to the ransom note or visit the links in it. If payment ever comes up, that is a decision for the owner with legal advice and your insurer, not something to do from the front desk.

Preserve the evidence

Do not wipe, reinstall or “clean up” anything yet. CISA recommends taking a system image and memory capture from a sample of affected machines and keeping the relevant logs. Your IT provider should do this before any rebuild.

Write down what you can see. IC3 asks complaints to include:

• the ransomware name, if the note gives one
• the file extension added to encrypted files
• the cryptocurrency type and wallet address in the note
• any email addresses and websites the attackers gave
• the ransom amount, and whether anything was paid

A phone photo of the ransom note on screen covers most of that.

Report it

CISA’s guide says to report the incident to CISA, your local FBI field office, the FBI’s Internet Crime Complaint Center at ic3.gov, or your local Secret Service field office. CISA takes reports at cisa.gov/report or 1-844-729-2472. HHS’s fact sheet also recommends contacting your local FBI or Secret Service field office.

Restore only from clean backups

CISA warns that attackers often leave other malware behind, and that it must be found before you rebuild from backups. Restore from offline backups, most important systems first, and do not plug cleaned machines back into an infected network. For a dental office that usually means the server with the practice database first, then the front desk, then operatories and imaging. Keep a paper schedule and a printed day sheet ready so the office can keep seeing patients.

HIPAA breach notification basics

HHS’s ransomware fact sheet says the presence of ransomware on your systems is a security incident under the Security Rule. It also says that when patient data is encrypted by ransomware, a breach is presumed, unless you can show a low probability that the data was compromised. That showing is a risk assessment of at least the four factors in 45 CFR 164.402: what information was involved, who got it, whether it was actually acquired or viewed, and how far the risk has been reduced.

If it is a breach of unsecured patient information, the federal rules set these timelines:

• Patients: without unreasonable delay and no later than 60 calendar days after discovery (164.404). Discovery is the first day the breach was known, or would have been known with reasonable diligence, to anyone on your staff other than the attacker.
• HHS, 500 or more people: at the same time as the patient notices (164.408).
• HHS, fewer than 500 people: keep a log and report within 60 days after the end of the calendar year (164.408).
• Media: if more than 500 residents of one state are affected, notify prominent media outlets in that state within the same 60 days (164.406).

HHS’s fact sheet also explains when data you had already encrypted may fall outside these rules, and why that depends on how the encryption was set up. This guide describes what HHS publishes. It is not legal advice. Confirm your obligations, including any Maryland requirements, with your compliance adviser.

Where we come in

If you are dealing with ransomware now, call us for emergency repair and recovery. If you want to check your backups before it happens, book a free on-site assessment.