9M Dental Patients Affected by LockBit Attack on MCNA

The government-sponsored dental and oral healthcare provider warned its customers that a March attack exposed sensitive data, some of which was leaked online by the ransomware group.

A US government-sponsored provider of dental healthcare is warning nearly 9 million clients that their sensitive and private personal and medical data was exposed in a LockBit ransomware attack that occurred earlier this year.
Managed Care of North America (MCNA) Dental — which works with various Medicaid agencies, the Childrens Health Insurance Programs, corporations, and insurance plans —
put out a notice
on May 26, before the Memorial Day weekend, that a cyberattack that occurred between Feb. 26 and March 7 successfully lifted sensitive data from its computer systems.
The breach affected more than 8.9 million clients of MCNA, according to
a data breach notification
filed with the Maine Attorney General. The Atlanta-based healthcare organization is one of the countrys largest providers of government-sponsored dental care and oral health in the US.
On March 6, 2023, MCNA became aware of certain activity in our computer system that happened without our permission, the company said in the post on its website. We quickly took steps to stop that activity.
Those steps were not quick enough to stop LockBit ransomware — which took responsibility for the attack — to make good on a threat to leak 700GB of data stolen from MCNAs systems if the provider did not pay $10 million in ransom. On April 7, the group released all of the data on its website for anyone to download,
according to reports
.
Included in that stolen data was a slew of personally identifiable information (PII) about MCNA clients — which may in some cases be for a parent, guardian, or guarantor of someone receiving service through the agency, the company said. This data included patient names, addresses, dates of birth, phone numbers, email addresses, Social Security numbers, and drivers licenses or other government-issued ID numbers, according to MCNA.
Data leaked in the attack also included details about clients health insurance — including plan information, insurance company, member number, Medicaid-Medicare ID numbers, and what type of care they received from their provider. Attackers also stole bill and insurance claim info in the breach, according to MCNA.
We are sorry for any concern this event may cause, the company said in the notice, adding that it will mail letters separately to people whose information may have been involved in the breach. The notice will remain active for 90 days to inform clients whose addresses that MCNA does not have and thus cannot be informed through the mail, it added.
MCNA also is offering clients affected by the breach an
identity theft protection service
for one year, and encouraged people to contact them via a toll-free number with any questions or concerns.
LockBit, a ransomware-for-hire group that
emerged as early as September 2019
, is one of the more prolific ransomware gangs currently active on the scene. The group has made a name for itself by targeting high-profile victims — such as
SpaceX
and security giant
Entrust
— with its style of double-extortion ransomware, using auto-propagating malware and double-encryption methods that show a level of sophistication.
LockBit may have suffered a setback when one of its alleged leaders, dual Russian-Canadian citizen Mikhail Vasiliev,
was arrested
in Ontario, Canada, in November, but it hasnt stopped the gang from launching a
slew of attacks
since then, leaking data from its victims along the way.
While the advice security experts traditionally gave to organizations that are victims of ransomware was not to pay attackers, double-extortion attacks that result in data leaks that can harm both companies and their clients in the long run have changed the rules of the game. Some experts now advise
considering various factors
before deciding whether or not to pay a ransom, and that in some cases it might benefit them more in the long run to give in to attackers demands.
Organizations can protect themselves against ransomware attacks by shoring up their overall security defense posture in myriad ways, including implementing secure passwords and
multifactor authentication (MFA)
, so systems arent breached in the first place. They should also put up strong controls to defend against phishing attacks, as attackers often use credentials stolen in this way to gain initial access to a network to deploy ransomware, experts said.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
9M Dental Patients Affected by LockBit Attack on MCNA