Nearly 9 million people affected by data breach from cyberattack on dental insurer

A ransomware attack on a major dental insurance provider leaked the personal information of nearly nine million people across the United States, according to documents filed with state regulators.

Managed Care of North America (MCNA) is the largest dental insurer in the nation for government-sponsored Medicaid and Children’s Health Insurance Programs, providing services to more than five million members across eight states.

On March 6, its IT team became aware of a hack and later discovered that “certain systems within the network may have been infected with malicious code.”

On March 27, the LockBit ransomware group took credit for the attack, claiming to have stolen 700 gigabytes of data. An investigation — completed on May 3 and led by a cybersecurity firm — revealed that hackers had been in MCNA’s systems from February 26 to March 7 and had made copies of information.

LockBit published all of the files on April 6 after a $10 million ransom was not paid.

The company said the breach included full names, dates of birth, addresses, phone numbers, email addresses, Social Security numbers, driver’s license numbers, government-issued identification numbers, health insurance information — such as the name of the plan, insurer or government payor — and information regarding dental and orthodontic care.

In a notice on their website, the company said the information stolen included more specific information about patient visits, like a dentist's name, X-rays, photos, treatment and bills. Some of the information was for the parents or guardians of patients.

“As soon as we discovered the incident, we promptly launched a forensic investigation, took steps to mitigate and remediate the incident and to help prevent further unauthorized activity, and contacted law enforcement,” the company said in breach notification letters shared with state regulators in Maine.

They are offering 12 months of identity protection services to the 8,923,662 people affected.

MCNA noted that they are sending out the letters on behalf of more than 100 organizations, including dozens of government agencies and unions for teachers, police officers, nurses and more.