05/08/2024
Dear State and Local Executive Directors,
The FBI reached out to the ADA to let us know there is a credible cybersecurity threat to oral and maxillofacial practices. While the FBI was not yet aware of any cyberattack victims of this threat, the agency is concerned that the practices of general dentists and other specialists could also be eventually targeted.
We looped in AAOMS, and they are communicating to their members. In addition, we have developed an ADA communications plan working with subject matter experts in Technology and Legal.
Elements of the plan, which will be executed beginning tonight and over the next few days, include an email Issues Alert to dentists, an ADA News story, Huddle summary, targeted and boosted social media posts for dentists, and news and resources on a webpage we are building at www.ADA.org/riskmanagement (so named because there are a variety of resources on the page, not limited to cybersecurity).
Please let us know if you have any questions. Thank you!
ADA Client Services
Issues Alert
The American Dental Association (ADA) urges all dental practices to remain vigilant after it was contacted by the Federal Bureau of Investigation (FBI) with information regarding a credible threat to the practices of oral and maxillofacial surgeons.
Current Threat Information from the FBI
On Tuesday, May 6, 2024, the FBI informed the ADA and the American Association of Oral and Maxillofacial Surgeons (AAOMS) of a credible cybersecurity threat to the practices of oral and maxillofacial surgeons. The FBI said that as of that date there were no known cyberattack victims, but the agency is working proactively to raise awareness to help prevent victimization. The FBI suspects the group behind the cyberattacks may be shifting tactics to oral and maxillofacial surgery practices after targeting plastic surgeons last year.
While this current threat is focused on oral and maxillofacial surgeons, the FBI is concerned that the practices of general dentists and other specialists could also eventually be targeted.
Cybercriminals often use social engineering scams – such as phishing (email), SMSishing (through text or instant messaging apps) and vishing (using phone calls and voicemail) – to gain access to sensitive personal data such as electronic protected health information. Spear phishing refers to a phishing email appearing to be from a trusted contact. For example, a threat actor may use phishing to impersonate a credentialing agency. Through these scams, threat actors try to convince people to reveal sensitive information, or to click on a link, open an attachment or visit a website that causes malware to be deployed. This malware can lead to ransomware, which blocks system and/or file access until money is paid.
The FBI provided an example in which the threat actor poses as a new patient or says they want to become a patient at the practice to obtain new patient forms online. Once the forms are received, the threat actor will then contact the practice to report they are having trouble submitting them online and ask if they can scan the forms and email them instead. The threat actor then emails the “forms” as an attachment. When the attachment is opened malware is deployed in a phishing scheme.
The FBI requests dental practices that experience any fraudulent or suspicious activities to report them to the FBI Internet Crime Complaint Center at ic3.gov.
Precautions Practices Can Take
The Cybersecurity & Infrastructure Security Agency (CISA) recommends four vital ways to protect your practice from cyberthreats:
· Teach your team to recognize and avoid phishing
· Require strong passwords
· Require multifactor authentication
· Update all business software
The following resources are also available to support healthcare professionals:
· A CISA.gov toolkit aids healthcare practices in building cybersecurity foundations and implementing more advanced, complex tools to stay secure and ahead of current threats.
· The U.S. Department of Health and Human Services’ Knowledge on Demand resource offers five free cybersecurity trainings that align with the top five threats named in HHS’ Health Industry Cybersecurity Practices. HHS also offers information on how the HIPAA security rule can help defend against cyberattacks.
· The Office of the National Coordinator for Health Information Technology’s Security Risk Assessment Tool, a resource designed to help medium and small providers conduct a security risk assessment as required by the Health Insurance Portability and Accountability Act.
· The U.S. Department of Health and Human Services Office of Information Security and Health Sector Cybersecurity Coordination Center’s “Artificial Intelligence, Cybersecurity and the Health Sector” guide shares how health care entities help protect against AI-enhanced cyberthreats.
· Additional resources can be found at ADA.org/riskmanagement
As the nation’s largest organization of dentists, the ADA is advocating on behalf of all dentists at the federal level to recommend several measures to protect and ensure the resilience of health care infrastructure against cyber threats. The ADA will continue to lead this charge and provide cybersecurity updates as they become available, all in service to you and your patients. Please visit ADA.org to see the many ways the ADA advocates on behalf of dentists nationwide.
________________________________________________________________________
American Dental Association 211 E. Chicago Ave. Chicago, IL 60611 www.ada.org
The American Dental Association is your source for clinical guidelines, oral health research, and industry news and data to support your career in dentistry.
