Sarrell Dental sarrelldental.com Sarrell Dental data breach: what happened and what to do
Sarrell Dental, an Alabama dental group, was hit by ransomware in 2019. Reports put the number of patients at 363,617 (HHS case description) to 391,472 (later press). Names, addresses, birth dates, Social Security numbers and insurance details were involved.
View all 13,177 breaches- Breach date
- 12 Sept 2019
- Made public
- 12 Sept 2019
- Data exposed
- Names, Physical addresses, Dates of birth, Health insurance information, Social security numbers, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Sarrell Dental, a dental group based in Anniston, Alabama, was the victim of a ransomware attack in 2019. Press reports say it closed its 15 practices for about two weeks while it rebuilt its systems, and that it did not pay the ransom. It notified HHS on September 12, 2019.
The count differs by source. HHS's case description lists 363,617 people. Trade press, including Becker's Dental and HIPAA Journal, reported 391,472 patients. Both are in the hundreds of thousands.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, beckersdental.com
Last verified against the official page:
What was exposed
HHS says the information included names, addresses, dates of birth, health insurance information, Social Security numbers and treatment information. Press reports add dates of service and diagnosis and procedure codes. Reports say the investigation found no evidence that files were copied or removed from the network.
What that means for you
With a Social Security number and date of birth, a criminal can try to open credit in your name. Insurance details can be used for medical identity theft, and treatment information makes phishing messages more believable.
What Sarrell Dental did
HHS reports that the practice notified HHS, patients and the media, posted a substitute notice on its website, offered complimentary credit monitoring and identity protection, and added safeguards and staff training.
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion. It stops new accounts being opened in your name. The FTC explains how freezes and fraud alerts work. Then check your reports at annualcreditreport.com.
- 2
Check your insurance statements
Read explanation-of-benefits letters for treatment you didn't get. The FTC's data breach guidance explains what to do if someone uses your details.
- 3
Use the free monitoring if you were offered it
If you got a letter from Sarrell Dental, it describes the credit monitoring on offer and how to sign up.
- 4
Be careful with messages about the breach
Expect phishing that mentions Sarrell Dental or a dental bill. Don't click links; contact your provider using a number you already trust.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email and phone and shows what else is out there.
Official filings
- U.S. Department of Health and Human Services , filed 12 Sept 2019 : 363,617 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
How many people were affected?
HHS's case description lists 363,617 people. News outlets reported 391,472 patients.
Was I affected?
Sarrell Dental notified affected patients by mail and posted a notice on its website. If you were a patient and got a letter, your information was involved.
Should I freeze my credit?
The FTC says a credit freeze is free and blocks new accounts in your name. Social Security numbers were involved here, so it is worth considering.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- hipaajournal.com/391472-patients-impacted-by-sarrell-dental-ransomware-attack/
- beckersdental.com/dentists/alabama-dental-group-alerts-400-000-patients-of-ransomware-attack-that-closed-practices-for-2-weeks/
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
