09/07/2026
BREACH OF THE WEEK - LABOR DAY WEEKEND EDITION
There is a countdown clock running on a company that thousands of dental practices hand their logins to, and most of those practices have no idea.
On Saturday evening, the Dire Wolf ransomware group posted a listing for eAssist Dental Solutions, the outsourced dental billing and insurance claims company.
The data has not been released. I want to be precise about that, because it is the entire point of this post. What Dire Wolf published is an inventory, a detailed catalog of what they claim to be holding, alongside a countdown timer. As I write this, that timer shows about 13 days.
That inventory is not journalism. It is leverage. Groups publish a detailed manifest specifically to show a victim they are not bluffing, and to make the consequences vivid enough to force a payment. Which means two things at once: the detail is designed to alarm, and the numbers may well be inflated.
It also means there is still time.
First, in fairness to eAssist. They are a well regarded company and a CDA endorsed partner. This is not a shot at them. Any vendor in this industry can end up on one of these pages, mine included. And they have not made a public statement, which is exactly what you would expect from a company in the middle of an active negotiation. That silence is not evasion. Read nothing into it.
What the group claims to be holding, per their own inventory:
- Roughly 26 GB, 213 database tables, about 12.8 million rows
Records spanning 2001 through 2026
- Insurance carrier portal logins, listed at 13,119
- Per office dental software and remote access passwords inside an office master covering 10,343 dental offices
- File transfer and cloud storage credentials
- An employee user master with password columns, roughly 20,878 accounts
- EOB and claim form records, roughly 530,000 rows, with insured and patient names, dates of birth, payers, and procedure narratives
- 160,142 patient concern tickets and 56,020 patient financial reports
- ACH authorizations with account and routing fields, plus SSN and EIN fields
- 72,719 applicant files, payroll across 3.29 million rows
- Roughly 13.4 GB of email archives
Again: their claim, unverified, and written to frighten someone into paying. Treat every number as "they say."
But look at the second and third lines, because that is where practices live.
Carrier portal logins. Dental software and remote access passwords for more than ten thousand offices.
If your practice is in that file, someone may be holding the password to your practice management system and to the carrier portals where your patients' information sits. Not eAssist's password. Yours.
And the date range is the part nobody is talking about. Records reaching back to 2001 means this is not only current clients. If you used eAssist years ago and moved on, you may still be in there.
Now ask the uncomfortable question: is any password from that era still in use somewhere in your office today? For most practices I walk into, the answer is yes.
Here is why the clock matters more than the inventory.
A stolen credential is only worth something if it still works.
You have roughly two weeks before anything might be released. Every login you change between now and then is a login that is worthless the moment it drops. You cannot un-steal the data. You can absolutely make the most dangerous part of it useless, and you can do it this week, on your own, without waiting for anyone's investigation to conclude.
That is a rare position to be in. Usually I am writing these after the fact.
If your practice uses eAssist, or used them at any point, do this now:
- Change every insurance carrier portal password, at every carrier. These are the most reused and least rotated credentials in dentistry. Start here.
- Change your practice management software passwords and every remote access credential, then review the access logs for sessions you do not recognize.
- Turn on multi factor authentication wherever it exists, especially remote access and email. If it is already on, re enroll rather than assume.
- Email eAssist and ask what data of your practice is involved. In writing, so there is a record. They may not be able to answer fully yet. Ask anyway, and keep the reply.
- Call your HIPAA compliance partner. Not your IT company. Under HIPAA your billing company is a Business Associate and you are the covered entity. If patient information is ultimately involved, the notification duty is yours. Your letter, your name on the HHS portal.
- If they hold ACH authorizations for you, tell your bank and ask them to flag the account.
- Brief your front desk on phishing now, not later. If years of genuine billing email are in play, the follow up messages will reference real claims, real patients, and real payers. That is where the second wave always comes from.
Do not go looking for this. There is nothing to find yet, and going to look means visiting an active extortion site. It will not tell you anything you can act on, and it can create a problem you did not have. If you need to know whether you are affected, ask eAssist in writing, ask your compliance partner, or ask someone like me.
On the timing, since it is Labor Day. They posted on the Saturday of a holiday weekend. That is deliberate. Offices are dark, IT is off, and nobody reads anything until Tuesday. It is a well worn pattern, and it is exactly why I am writing this today instead of Wednesday.
For context, Dire Wolf has claimed 127 victims since surfacing in May 2025, 52 of those in the last thirty days, across 36 countries.
Healthcare is their most targeted sector. They also disable backups and suppress event logging before they encrypt, which is worth knowing if you have ever assumed you would notice something going wrong.
Rotate the credentials. You do not have to believe a criminal to change a password. You only have to accept that nobody can currently rule it out, and that an afternoon of inconvenience is not a close call against the alternative.
Anthony Jurjevic, CISSP
Techspedient. Cybersecurity-First. Dental-Focused. Built for Healthcare.
