AAOMS has been made aware of a new cybersecurity scheme – often referred to as a “dental download” attack – that is specifically targeting oral and maxillofacial surgery practices. This tactic relies on social engineering and can compromise your systems in a single click.
In this scheme, cybercriminals typically pose as referring providers. They contact the practice using a real email address from the provider. The email then requests that the practice download forms, records, images or other “dental files” from an email link or shared drive because they are “too large to fax” or they are “having trouble with the online form.”
The link or attachment may appear legitimate, but it can install a screen sharing application that cannot be blocked by anti-virus software or a firewall and provides remote access to your network.
AAOMS urges all members to:
- Be suspicious of unsolicited links and downloads. Do not open attachments or click links from unknown senders or unexpected messages – even if the sender appears familiar.
- Verify before you download. If someone requests that you download files or use a new file-sharing link, independently verify their identity (for example, by calling a known phone number for the referring office).
- Use secure workflows. Require patients and referring providers to use your established, secure portals and processes for sharing forms and images.
- Involve your IT/cybersecurity vendor. Ask them to review this threat, update filters and ensure backups, MFA, endpoint protection and staff training are in place.
- Report suspicious activity. Possible cyberattacks should be reported to the FBI Internet Crime Complaint Center at ic3.gov.
Black Talon Security, a leading expert in cybersecurity, has developed a brief video for AAOMS describing this new threat. AAOMS encourages you to watch it and share it with your entire team.
