The first sign is usually small. The front desk cannot open the schedule, a hygienist's X-rays will not load, or a workstation shows a message nobody recognizes. Within an hour, the practice is turning patients away, the phones are ringing with questions nobody can answer, and the owner is trying to figure out whether the patient records still exist.
That is what ransomware looks like in a dental office, and it is far from rare. Healthcare was the most targeted critical infrastructure sector in the FBI's 2025 internet crime data, with 278 ransomware attacks on healthcare organizations reported to the FBI's Internet Crime Complaint Center. Dental practices hold the same kind of patient data hospitals do, often with far fewer security resources.
This post walks through what recovery from a ransomware attack actually involves for a dental practice, from the first hour through the weeks that follow, and what separates the practices that are seeing patients again in a day from the ones that are down for weeks.
The First Hours Decide How Bad the Next Weeks Will Be
When ransomware is discovered, the instinct is to start fixing things: reboot the server, restore a backup, get the schedule back up. That instinct makes recovery harder. The first priority is containment, which means disconnecting affected machines from the network, disabling remote access, and stopping the encryption from spreading to systems that have not been hit yet.
Just as important is preserving evidence. The logs, the ransom note, and the state of the affected machines are what investigators, your cyber insurance carrier, and potentially regulators will need to determine how the attackers got in and what they accessed. Wiping a server and restoring it before anyone has looked at it can make it impossible to answer those questions later.
In the first few hours, a practice should also contact its cyber insurance carrier, if it has one. Many policies require notification before you engage outside responders or make recovery decisions, and they often provide incident response teams directly.
Front Desk Staff Need a First-Hour Checklist Before They Need It
Ransomware is often discovered by whoever is first to log in, which in a dental office is usually a front desk coordinator or an assistant, not the owner or the IT provider. What that person does in the first few minutes matters, so the steps should be written down, posted somewhere visible, and reviewed with the team:
- Do not turn off or restart the affected computer. Unplug its network cable or turn off Wi-Fi instead.
- Do not click on the ransom message, pay anything, or contact the attackers.
- Call your IT provider immediately, then the practice owner or office manager.
- Take a photo of the ransom note and any error messages on screen.
- Write down the time the problem was noticed and which computers are affected.
- Switch to your downtime procedure: a printed or exported copy of the day's schedule, paper charting for urgent cases, and a script for calls from patients.
The downtime procedure is the step most offices skip. Exporting tomorrow's schedule at the end of each day takes a minute, and it means the team can still contact patients and triage urgent cases while the systems are down.
Recovery Speed Depends on Backups Made Long Before the Attack
Once the attack is contained and documented, the question becomes how to rebuild. For most dental practices, the answer comes down to the condition of their backups, and that was determined weeks or months earlier.
Modern ransomware groups know that backups are what let victims recover without paying, so they look for them. Backups stored on the same network, on a drive that stays connected to the server, or in a cloud folder that syncs automatically can be encrypted or deleted along with everything else. The backups that survive are the ones stored offline or in immutable storage that cannot be changed or deleted for a set period.
Even with clean backups, the restore has to cover the whole practice, not only the practice management database. A dental office also needs its imaging archive, imaging software configuration, the bridges between imaging and practice management, and workstation settings before clinical work can resume. CBCT studies and years of radiographs make dental backup sets large, and restoring them over a slow connection can take far longer than practices expect. Our dental technology integration guide covers how those systems depend on each other.
Rebuilding Means Replacing Trust in Every Machine
Restoring data is only part of recovery. Before a practice reconnects to the internet, every workstation and server that may have been touched needs to be checked or rebuilt, because attackers often leave behind accounts or tools they can use to come back.
That typically means resetting every password, especially administrator and email accounts, revoking and reissuing remote access for vendors, rebuilding servers from known-good images, and confirming endpoint protection is running everywhere. It also means closing whatever let the attackers in, whether that was a phishing email, an exposed remote desktop connection, a reused password, or an unpatched system. A practice that restores its data onto the same vulnerable setup is likely to be hit again.
Ransomware in a Dental Office Is Usually a HIPAA Breach Until Proven Otherwise
Under HHS guidance, when ransomware encrypts electronic protected health information, the encryption itself is treated as an unauthorized disclosure. Unless the practice can show through a documented risk assessment that there is a low probability the data was compromised, the incident is presumed to be a reportable breach.
That has real consequences. Affected patients have to be notified, HHS has to be notified, and breaches affecting 500 or more people are posted publicly by HHS and, when more than 500 residents of a state are affected, require notice to prominent media outlets. Many ransomware groups now also steal data before encrypting it and threaten to publish it, which makes the low-probability argument harder to make.
Regulators are also looking at what happened before the attack. In April 2026, OCR settled four separate ransomware cases totaling $1,165,000, each involving an inadequate risk analysis. A current HIPAA risk assessment is one of the most important documents a practice can have when a breach investigation begins.
The Real Cost Is Mostly Downtime, Not the Ransom
Discussion of ransomware tends to focus on the ransom demand, but for a dental practice the larger cost is usually the time the office cannot see patients. Every day the schedule is down means cancelled appointments, lost production, staff paid to wait, and patients who may not come back. Add incident response fees, legal counsel, patient notification, credit monitoring, and the cost of rebuilding systems, and the total can be many times the ransom amount.
Paying the ransom does not reliably shorten that list. Decryption tools provided by attackers can be slow or incomplete, stolen data may still be published, and the practice still has to investigate, notify, and rebuild. That decision should be made with legal counsel and the insurance carrier, never under pressure in the first hour.
Practices That Recover in a Day Prepared for It in Advance
The difference between a one-day disruption and a multi-week shutdown usually comes down to a handful of decisions made before anything happened:
- Offline or immutable backups of the practice management database, imaging archive, and system configurations, with at least one copy that cannot be reached from the office network
- Tested restores on a schedule, confirming that the database opens, images display in the chart, and bridges reconnect
- Multi-factor authentication on email, remote access, and cloud platforms, which stops many of the account takeovers that lead to ransomware
- Segmented networks so a compromised guest device or older imaging workstation cannot reach the server
- Controlled vendor access, with separate credentials and access enabled only when needed
- A written incident response plan that names who to call, in what order, including the IT provider, insurance carrier, and legal counsel
- Staff training on recognizing phishing, since email remains one of the most common ways attackers get their first foothold
Each of these is a known, practical step, and none requires an enterprise budget. Together they can turn a ransomware attack into a short disruption instead of a weeks-long shutdown.
The broader numbers show why this matters. In 2025, 710 large healthcare data breaches were reported to HHS, exposing the information of at least 61.5 million people. Backups that are offline or immutable, regularly tested, and sized for imaging data are what make a fast recovery possible when a practice ends up in that group.
How Kota Technology Helps Dental Practices Prepare and Recover
Kota Technology supports dental practices across South Dakota, North Dakota, and neighboring markets, and ransomware readiness is part of how we approach every dental office we support: backups sized for imaging data with tested recovery, multi-factor authentication, properly segmented networks, and an incident response plan your team can follow. Our dental backup and disaster recovery and cybersecurity services are built around getting a practice back to seeing patients quickly.
If you are not sure your backups would survive a ransomware attack, or you have never tested a full restore, we can review your setup and show you where the gaps are. For more on how we support dental offices, see our dental IT services page, or schedule a consultation at (605) 799-1199.
