MMG Fusion mmgfusion.com MMG Fusion data breach: what happened and what to do
In December 2020, dental practice management service MMG Fusion was breached. Have I Been Pwned counts 2,660,295 accounts, with email addresses, names, phone numbers, dates of birth, genders, physical addresses and appointments. A few records had hashed passwords.
View all 13,115 breaches- Breach date
- 20 Dec 2020
- Affected
- 2,660,295
- Data exposed
- Appointments, Dates of birth, Email addresses, Genders, Marital statuses, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
MMG Fusion is a dental practice management service. In December 2020 it was the victim of a data breach, and in August 2021 Have I Been Pwned (HIBP) added it, counting 2,660,295 accounts. The breach exposed about 2.6 million unique email addresses.
The data had been reported in security roundups earlier in 2021, including a Risk Based Security summary.
What was exposed
HIBP lists these data types: appointments, dates of birth, email addresses, genders, marital statuses, names, passwords, phone numbers and physical addresses. Passwords were only in a small number of records and were stored as bcrypt hashes, a slow hashing method that makes guessing hard.
The mix is mostly contact and identity detail tied to a dental patient. A name, date of birth, phone number and home address together are enough for a convincing scam call that mentions your dentist, or for an attempt to answer your security questions. Appointment records make a fake reminder text believable.
What to expect
If you were a patient of a practice that used the service, your practice is the place to ask. The steps below are the ones that matter for this kind of data.
What to do if you were in it
- 1
Check whether you are in this breach
Search your email address on Have I Been Pwned. If it shows up, your name, phone number and address may have been in the data too.
- 2
Expect fake appointment messages
Treat texts and emails about dental appointments, bills or insurance with suspicion if they arrive unprompted. Call your dentist on a number you already have.
- 3
Change reused passwords
If you reused the password from any dental portal elsewhere, change it on each site and turn on two-factor login.
- 4
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web and alerts you when your email, passwords or other personal data appear, and tells you what to do next. It can't remove data that has already leaked, so the alert is the point: it tells you which passwords to change. You can run a free scan.
Frequently asked
Was I affected by the MMG Fusion breach?
Search your email on Have I Been Pwned. About 2.6 million email addresses are listed.
What was exposed?
Appointments, dates of birth, email addresses, genders, marital statuses, names, phone numbers and physical addresses. A few records included bcrypt-hashed passwords.
Should I change my password?
Only a small number of records had passwords, and they were hashed. Change any password you reused from a dental portal anyway.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
