A hacker group has claimed responsibility for a ransomware attack against eAssist Dental Solutions, a Utah-based outsourced dental billing and revenue cycle management company, according to multiple technology and web monitoring sites.
In September, cybercriminal group Direwolf claimed on a dark web leak site that it had struck eAssist, which is majority-owned by Henry Schein, according to the sites.
On September 9, eAssist released the following statement to DrBicuspid:
"We take the security and privacy of the information entrusted to us seriously and are investigating the nature and scope of the matter with the support of experts. The investigation is ongoing as we work to understand the nature and scope of the matter. We will take appropriate action based on our findings, including notifying affected parties as required. We will provide additional information as appropriate as the investigation progresses."
On September 8, eAssist sent the following statement to its clients:
“We want to make you aware that eAssist is investigating a potential information security incident. We recognize the trust you place in us and take the security and privacy of the information entrusted to us seriously. We have engaged experts to support our investigation and response. The investigation is ongoing as we work to understand the nature and scope of the matter, including whether any customer or patient information was affected.
"We will take appropriate action based on our findings, including providing notifications and guidance to affected parties as required. We will keep you informed and provide additional information as appropriate as the investigation progresses.
"Out of an abundance of caution we recommend that you change your system passwords and remove old/inactive user accounts in your practice management software, clearinghouses, claim software, and portals.
"We understand the importance of this issue to you, your practice, and your patients, and appreciate your patience as we work to establish the facts."
To date, Direwolf has claimed that it has gained access to the internal systems of eAssist, which runs a cloud-based platform that integrates with dental practice management software and employs about 1,750 dental billers that serves about 3,000 dental practices throughout the U.S. However, the possible scope of exposed data remains unknown, according to the posts.
Emerging in 2015, Direwolf has been linked to targeted, financially motivated attacks against a variety of businesses, including healthcare organizations. The gang uses a double-extortion model that combines encrypting a business’s system with the threat of releasing sensitive data. In the past, Direwolf has claimed responsibility for attacks on global merchant of record and billing platform Dodo Payments and the Legal Practice Board of Western Australia.
What clients should do
Though this remains an unverified attack, Tasha Dickinson, founder and chief technologist at Siligent Technologies, told DrBicuspid that eAssist customers should use this opportunity to review the software they use.
“This is a great time to understand what you have connected to your practice management software and whether it's secure, updated, and used,” Dickinson said. “Oftentimes we sign up for services, but when we close accounts or move, we forget to remove the software off our PCs. Or as we sign up for new software, we forget to ask the right questions or forget to have a BAA [business associate agreement] signed and on file. Review what you have connected by calling your practice management software support, or find your APIs. Then cross-check that those that have access to your data are taking their security as importantly as you are.”
Nevertheless, this isn’t the first time Henry Schein businesses have been embroiled in a cybersecurity incident.
In October 2023, Schein announced that its manufacturing and distribution businesses were struck by a ransomware attack. Actions were taken, including taking certain systems offline, to contain the cyber incident, which disrupted some of Schein’s business operations.
The ransomware as a service hacker BlackCat claimed responsibility for the strike.
In December 2023, a data breach notification revealed that cybercriminals that hit Henry Schein not only may have accessed the personal data of about 29,000 people, but the ransomware gang infiltrated the company's network for more than two weeks before it was discovered.
The cyberstrike occurred on September 27, 2023, but Henry Schein did not discover it until October 14. A day later, the dental distributor notified the public of the cybersecurity incident and that it was taking most of its systems offline.
