The vulnerability, tracked as CVE-2026-83844, is a remote code execution (RCE) flaw in Windows Paint. A fix is now available. The catch: Windows Update will not install it. The patch ships only through the Microsoft Store, which means a practice that relies on Windows Update alone — as most do — can be fully “up to date” and still carry the hole.

What CVE-2026-83844 actually is

CVE-2026-83844 is described as an unauthenticated remote code execution flaw in Microsoft Paint. In plain terms, remote code execution is the most serious class of software bug: it means a specially crafted file, once opened in the vulnerable program, can run an attacker’s own instructions on the machine. “Unauthenticated” means the attacker does not need a password or an existing foothold — the booby-trapped file does the work.

The realistic attack path for a practice is mundane: a malformed image arrives as an email attachment, a download, or a file dropped on a shared folder, and a staff member opens it in Paint. From there, an attacker can attempt to run code under that user’s account — the first step toward installing malware, moving across the network, or reaching the systems that hold patient records.

The real story: a patch Windows Update won’t deliver

Here is the part that matters operationally. The corrected version of Paint — build 11.2609.401.0 — is distributed through the Microsoft Store, not through the monthly Windows Update channel. It landed in the Store in early November 2026. Windows Update does not deliver it at all.

Modern Windows apps like Paint, Notepad, Photos and the Snipping Tool are “Store apps.” They update on their own track, through the Store, separately from the operating system. On a well-run home PC with automatic Store updates enabled, that mostly takes care of itself. In a managed practice environment it often does not — Store updates are frequently throttled, delayed, or deliberately blocked by policy, and older copies of the app can linger even after a newer build is available.

The result is a dangerous illusion of safety. A workstation can show a green “you’re up to date” checkmark from Windows Update while a built-in app on the same machine carries a critical, unpatched RCE flaw. The system was patched. The app was not.

Why this is a bigger problem than one drawing tool

Paint is the example, not the lesson. The lesson is that a practice’s patch program almost certainly has a category it is not watching: Store-delivered applications. If your process is “Windows Update runs, therefore we’re covered,” then every Store app on every machine is outside your coverage — and you likely have no inventory of which versions are actually installed.

This is the same discipline we wrote about with the federal catalogue of known-exploited vulnerabilities: the point of patch management is not to install everything, it is to know what you have and to close the flaws attackers are actually using. A vulnerability you cannot see on an inventory is one you will never prioritise.

What a dental practice should do now

You do not need to panic over a drawing program, but you should use it as a prompt to tighten a real gap. Concretely:

• Verify the Paint version on every Windows 11 machine. Open Settings in Paint (or check the app’s version information) and confirm it is at least 11.2609.401.0. Anything older is unpatched.
• Force the update through the Microsoft Store. Open the Store, go to the library/downloads area, and run “Get updates.” If your environment blocks the Store for staff, your IT provider can push the specific app update through your management tooling instead.
• Unblock or enforce Store app updates where it is safe to do so. If Store updates are disabled by policy across the practice, that single setting is silently freezing every built-in app at whatever version shipped — flaws included.
• Add Store-app versions to your patch inventory. Whatever you use to track Windows updates should also track the versions of Store-delivered apps, so “up to date” means the whole machine, not just the operating system.
• Treat unexpected image files with the usual caution. The same staff awareness that defends against phishing applies here: don’t open attachments or files from unknown sources, especially on machines that touch patient data.

The pattern behind the panic headlines

One confusing wrinkle has surfaced: on some machines the Store shows no pending update, and the public vulnerability record and Microsoft’s guidance have not always lined up cleanly on version numbers. That ambiguity is itself the argument for verifying rather than assuming. Do not trust that a fix “must have arrived.” Check the installed build on each machine and confirm it for yourself.

This flaw belongs to the same family of risks as the patch-and-lifecycle issues we keep returning to — from the security baseline regulators now expect every practice to meet to the reality that attackers hunt for the one system you forgot to harden. The common thread is visibility. Breaches rarely come from the threat everyone is talking about; they come from the component nobody was tracking.

The bottom line

CVE-2026-83844 is a reminder that “patched” is not a single switch. Windows Update covers the operating system; the Microsoft Store covers a whole class of built-in apps on a separate schedule you may not be watching. A practice that only trusts one of those channels has a blind spot — and attackers make their living in blind spots.

If you are not certain whether every workstation in your practice is current across both channels, that uncertainty is the vulnerability. Contact Compudent Systems for a practice patch-management and security review, and we will make sure “up to date” actually means it — operating system, Store apps, and everything in between.

Sources & further reading:

• Microsoft Paint RCE Fix Now Available, but Windows Update Won’t Deliver It (The Hacker News)
• CVE-2026-83844 — Microsoft Security Response Center

Related Reading

• Windows Notepad Remote Code Execution Vulnerability (CVE-2026-20841) — Why Dental Offices Should Patch Immediately
• October 2026 Patch Tuesday: Microsoft Fixes a Record 1,400+ Flaws and an Exploited Windows Zero-Day — What Dental Practices Must Patch Now
• Microsoft March 2026 Patch Tuesday: Over 80 Critical Vulnerabilities Fixed – What Dental Practices Need to Know

The post The Patch Windows Update Won’t Install: A Critical Paint Flaw (CVE-2026-83844) and the Store-App Blind Spot in Your Practice appeared first on Compudent Systems.

A dental practice in the Greater Toronto Area answers to Ontario’s PHIPA, not to HIPAA, so it would be easy to file this under “American news.” That would be a mistake. Cyber threats do not respect the border, and neither do the cyber-insurers, software vendors and auditors who increasingly decide what “reasonable safeguards” means in practice. The proposed HIPAA rule is the clearest public statement yet of the security floor every practice that holds patient records will be expected to stand on. Here is what is in it, and why you should treat the checklist as the new baseline well before anyone forces your hand.

What the proposed rule actually is

On December 27, 2024, the Office for Civil Rights at the U.S. Department of Health and Human Services issued a Notice of Proposed Rulemaking — an NPRM — to modernize the HIPAA Security Rule, the national standard that governs how electronic protected health information is secured. It is the first major revision to that rule since the 2013 HITECH update, and it is a deliberate response to the relentless rise in attacks on healthcare organizations.

The crucial word, as of late 2026, is proposed. After an extended comment period, OCR has not issued a final rule, and the requirements, their timing, and even whether they survive at all could still change. This is not a deadline you are late for. It is a preview. But previews from a national regulator have a way of becoming the reference everyone else — insurers, vendors, courts — starts quoting, which is precisely why it pays to understand it now rather than scramble later.

The headline change: “addressable” becomes “required”

For twenty years, the HIPAA Security Rule split its safeguards into two tiers: required measures you simply had to implement, and addressable ones you could decline if you documented a reason. In practice, “addressable” became a loophole that many small offices read as “optional.” Encryption was addressable. So, effectively, were a number of the controls that would have stopped the breaches now in the headlines.

The proposed rule closes that loophole. It would remove the distinction between required and addressable and make nearly every implementation specification mandatory, with only narrow, documented exceptions. In one stroke, that converts a long list of “should” into “must.” Everything that follows flows from that single structural change.

The controls that would become mandatory

Stripped of legal language, the proposal names a concrete set of safeguards that would move from recommended to required. The ones that matter most for a dental practice are these:

• Multi-factor authentication (MFA) on every system that touches patient data, with limited exceptions. A stolen or guessed password would no longer be enough to open a record.
• Encryption of patient data both at rest and in transit, removing the old “addressable” flexibility. Data on a laptop, a server or a backup drive, and data moving between them, would have to be encrypted.
• A technology asset inventory and network map, maintained and reviewed at least every 12 months, documenting every device that stores or touches patient data and how that data moves between them.
• A defined testing schedule: vulnerability scans at least every six months and penetration testing at least every twelve.
• Contingency timelines: notification within 24 hours when a contingency plan is activated, and restoration of critical data within 72 hours of an incident.
• Written documentation of all policies, procedures, plans and risk analyses — if it is not written down, it does not count.

None of these would surprise anyone who has watched how modern breaches unfold. They are, almost line for line, the controls whose absence keeps showing up in the post-mortems.

Why an Ontario practice should care

PHIPA does not contain this checklist. What it contains is a duty to take “reasonable” steps to protect personal health information — and the meaning of “reasonable” is not frozen. It is set by the prevailing standard of care, and that standard is exactly what documents like the HIPAA proposal, cyber-insurance questionnaires and vendor security requirements are busy redefining in real time.

Consider where you already meet these expectations without a Canadian statute spelling them out. Your cyber-insurance renewal almost certainly now asks whether you enforce MFA and whether you encrypt backups; answer “no” and the premium climbs or the coverage shrinks. Your practice-management and imaging vendors increasingly ship with MFA and encryption on by default. The same compliance instinct that drives an Ontario practice to keep its radiography equipment inspected and documented under the HARP Act applies here: the safe assumption is that the controls a serious regulator now calls mandatory are the controls you will be judged against if something goes wrong, border notwithstanding.

Where most practices will have gaps

Run the list against a typical small office and the same soft spots appear. The asset inventory and network map is the one almost nobody has produced — practices rarely possess a written list of every device touching patient data, let alone a diagram of how that data flows, yet it is the foundation the rule builds everything else on. The 72-hour restoration target is the second: plenty of offices have backups, but very few have ever timed a real restore to confirm they could rebuild a server inside three days. We made that precise point when ransomware began hunting the backup appliances themselves — a backup you have never test-restored is a hope, not a recovery plan.

MFA is often half-done, enforced on email but not on the practice-management login or remote access. Encryption of backups and portable devices is frequently assumed rather than verified. And the regular testing cadence — vulnerability scans every six months, informed by which flaws are actually being exploited — is something most practices have never run at all, even though free resources like the federal catalogue of known-exploited vulnerabilities make the prioritization straightforward.

What to do now, before anything is final

The good news is that none of this requires waiting for a rule to be finalized, and none of it is exotic. A practice can work through the list on its own schedule and be meaningfully safer at every step:

• Build the inventory first. List every device, workstation, server, imaging unit and cloud service that touches patient data, and sketch how the data moves. Everything else depends on this.
• Turn on MFA everywhere it is missing — practice management, remote access, email and cloud imaging — not just the one or two systems that already have it.
• Confirm encryption on laptops, servers, portable drives and, especially, backups. “We think it’s encrypted” is not an answer.
• Test a real restore. Time how long it actually takes to bring a critical system back from backup, and fix the plan if it misses a 72-hour window.
• Schedule security testing — a recurring vulnerability scan and a periodic review — rather than waiting for an incident to find the gaps for you.
• Write it down. Document your policies, your risk analysis and your decisions. Under both HIPAA’s proposal and PHIPA’s reasonableness test, undocumented diligence counts for very little.

That same discipline extends to the everyday habits a rule can never fully capture, like keeping patient discussions off unsecured channels — the kind of day-to-day judgement we covered in looking at what HIPAA and PHIPA actually require when a team talks about patients in Microsoft Teams.

How Compudent can help

Compudent Systems helps dental practices across the GTA and Ontario get ahead of exactly this curve — not by reacting to a rule once it lands, but by building the baseline it describes while there is time to do it calmly. We produce the technology asset inventory and network map most practices have never had, enforce multi-factor authentication across every system that touches patient data, verify that laptops, servers and backups are genuinely encrypted, and test your recovery against a real 72-hour restoration target instead of taking it on faith. We set up the vulnerability-scanning cadence and the written documentation that turn good intentions into something you can actually demonstrate. If you are not certain your practice would stand on the floor this proposal describes, contact us for a practice security and compliance review — it is far easier to build the baseline on your own schedule than on a regulator’s or an attacker’s.

Sources & further reading:

• HIPAA Security Rule NPRM to Strengthen Cybersecurity for ePHI — Fact Sheet (HHS.gov)

Related Reading

• 2026 HIPAA Security Rule Changes: What Dental Practices Need to Know
• New HIPAA Security Rule Requirements: Mandatory Vulnerability Scanning and Penetration Testing for Dental Practices
• Can Your Dental Practice Use ChatGPT Without Breaking HIPAA and PHIPA? A 2026 Compliance Guide

The post MFA, Encryption, 72-Hour Restore: Washington’s HIPAA Overhaul Is a Preview of the New Security Floor for Every Dental Practice appeared first on Compudent Systems.

The latest example making the rounds, a botnet that researchers have named Dysphoria, is a useful illustration precisely because there is nothing exotic about how it works. It does not need a zero-day or a clever phishing lure. It walks in through doors that were left open years ago and never closed. Understanding how it spreads is the fastest way to see whether something in your own practice is already enlisted.

What the Dysphoria botnet actually is

A botnet is simply a large collection of internet-connected devices that have been quietly compromised and are now controlled by someone else, usually without the owner having any idea. According to reporting on the Dysphoria campaign, researchers at XLab have tracked it since early 2026 and put its size above 200,000 devices, with later scans by Shadowserver suggesting the real figure has grown closer to 300,000. The operators rent it out: their public site advertises distributed denial-of-service — DDoS — firepower, and a later variant of the malware repurposed infected devices as anonymising proxies to relay other people’s traffic.

The important detail for a practice owner is how it recruits. Dysphoria spreads through weak or default Telnet and SSH credentials and through known, already-patched vulnerabilities in routers, cameras and other internet-of-things hardware. In plain terms: it targets devices that still have the factory password and devices whose firmware has not been updated in a long time. Neither of those is a sophisticated failure. Both are extremely common in small clinical offices.

Why a dental practice is a target — and why you would not notice

Attackers running botnets are not hunting for interesting victims. They are hunting for numbers. Every device they conscript adds a little more bandwidth to a DDoS cannon or one more address to hide behind, so the game is volume, and small businesses are the easiest volume to find. A practice network is attractive for the dullest possible reasons: the equipment runs twenty-four hours a day, it is connected to a decent internet link, and nobody is watching it closely.

The unnerving part is the absence of symptoms. A conscripted router keeps routing. A camera keeps recording. Phones keep ringing. The device is simply doing a little extra work for a stranger in the background, and that work is invisible from the operatory. There is no pop-up, no ransom note, no locked screen — the business model depends on you not noticing, because an unnoticed device keeps working for the attacker for months. This silence is what separates a botnet infection from the ransomware events that dominate the headlines, and it is why these compromises persist for so long.

The devices in your office that are actually at risk

When people hear “internet of things” they picture smart fridges, and dismiss it. The reality in a dental office is more mundane and more exposed. The at-risk inventory usually includes:

• The internet router or gateway — the single most-targeted device, because it sits at the edge facing the internet.
• IP security cameras and their network video recorder — notorious for shipping with default passwords and for never receiving a firmware update after install.
• VoIP phone systems and their controllers — always on, often internet-exposed for remote features.
• Networked printers and multifunction devices — small computers in their own right, frequently overlooked entirely.
• Smart thermostats, door controllers, TVs and other “convenience” gadgets — added over the years, rarely inventoried, almost never patched.

What these share is that they are treated as appliances rather than computers. Nobody schedules maintenance for the camera recorder the way they would for the practice management server. That blind spot is the whole opportunity, and it is the same category of exposure we described when attackers began targeting the very hardware meant to protect the network in our look at why the devices guarding your practice network have become the target.

How these devices get conscripted

There are really only two doors, and both are ones you can close. The first is credentials. A huge number of routers, cameras and recorders are still running with the username and password they came in the box with, or with something a technician set once and everyone forgot. Automated scanners spray the internet with these common logins constantly; a device still using one is found within hours of being exposed.

The second door is stale firmware. Manufacturers release updates that fix security holes, but on appliance-style devices those updates almost never install themselves and almost never get installed by hand. A camera running three-year-old firmware is carrying three years of publicly documented vulnerabilities, each one a known, scripted way in. Dysphoria and botnets like it do not discover new flaws; they exploit old ones that practices never got around to patching. The lesson is the same one we keep returning to about the value of simply keeping current — the maintenance discipline we laid out for the practice server in the backup, patch and access checklist most practices skip applies just as much to the quiet box behind the front desk.

Why it matters even if you are “just a relay”

It is tempting to shrug at a compromise that does not lock up your files. That would be a mistake, for several concrete reasons. A device being used in attacks consumes your bandwidth and can degrade the performance of the imaging uploads and cloud software the practice depends on. Your internet address can end up on spam and abuse blocklists, which quietly breaks outgoing email and patient communication. If your connection is used to relay attacks or illegal traffic, that activity traces back to your practice first.

Most importantly, a compromised device is a foothold inside your network. A camera an attacker controls is not just a camera anymore; it is a vantage point from which to probe the systems that hold patient records. The distance between “harmless relay” and “breach of protected health information” is one lateral move, and under PHIPA the practice carries the accountability regardless of which box was the entry point. A device you treated as an appliance becomes a privacy liability.

A practical hardening checklist for your practice network

None of the defence here is exotic. It is a short list of unglamorous habits that, done once and maintained, take these devices out of the target pool:

• Change every default password on routers, cameras, recorders, phones and printers to something strong and unique, and record them somewhere controlled.
• Disable remote management, Telnet and unnecessary internet exposure on every device that does not genuinely need it — most do not.
• Update firmware on network devices on a schedule, not just when something breaks, and retire gear the manufacturer no longer supports.
• Inventory what is actually connected. You cannot secure a device you have forgotten is on the network; a current list is the foundation of everything else.
• Segment the network so cameras, smart devices and guests sit on a separate zone that cannot reach the clinical systems and patient data.
• Put a real firewall at the edge and watch for unusual outbound traffic — the signature of a conscripted device is connections leaving the network that nobody initiated.

Segmentation and a business-grade firewall deserve particular emphasis, because together they turn a compromised gadget from a network-wide crisis into a contained nuisance. We made the full case for that architecture in our guide to why a dental practice needs a business-grade firewall rather than a consumer box, and the same reasoning protects the network-attached storage and recorders that these campaigns love — the devices we warned about when ransomware began hunting practice backup appliances directly.

How Compudent can help

Compudent Systems helps dental practices across the GTA and Ontario treat the quiet hardware on their networks as what it really is: small computers that need the same care as the ones on the desks. We inventory every connected device, replace default credentials, close off needless internet exposure, bring firmware current and retire what can no longer be secured, and we design the segmented, firewalled network that keeps a compromised camera or printer from ever reaching your patient data. If you cannot say with confidence that nothing on your network is working for someone else right now, contact us for a practice network and device security review — it is far cheaper to check than to discover the answer the hard way.

Sources & further reading:

• New Dysphoria DDoS botnet spreads to 200k devices worldwide (BleepingComputer)

Related Reading

• DDoS attacks explained
• Attackers Rooted Fully-Patched Ivanti VPNs: What the Connect Secure Zero-Day Chain Means for Remote Access in Your Practice
• When the Firewall Itself Is the Backdoor: Why Attackers Now Target the Device Guarding Your Practice Network

The post A Botnet Just Conscripted Hundreds of Thousands of Devices: Is Your Practice Router or Camera One of Them? appeared first on Compudent Systems.

A radiation inspection is not something to dread. For a practice that keeps its records in order, it is close to a formality. For one that has never looked past the install, it can surface problems that were sitting in plain sight for years. The difference is almost entirely about preparation, and preparation is mostly about understanding what the inspector is actually there to check.

The machine is registered, and that registration has to be current

Under the HARP Act, an X-ray machine cannot simply be installed and used. It must be registered with the Ministry of Health, and the registration is tied to a specific machine at a specific facility. The first thing an inspection confirms is the boring but foundational fact that the device in your operatory is the device on file, that the registration is current, and that nothing changed — a relocation, a replacement tube head, a new owner — without being recorded.

This is where a surprising number of practices stumble. Equipment gets swapped out when a unit fails. A practice is sold and the paperwork never follows the machine. A second operatory is added and its new unit is quietly put into service. Each of those is a moment the registration should have been updated, and each is a gap an inspector will notice immediately because it is the easiest thing to check.

What quality-assurance testing actually measures

The heart of a radiation inspection is confirming that the machine does what it is supposed to do and nothing it is not. The technical benchmarks come from Health Canada’s Safety Code 30, Radiation Protection in Dentistry, which is the standard Ontario leans on for dental equipment performance. An inspector — or the qualified service provider doing your periodic quality-assurance testing — is looking at measurable things:

• Tube output and reproducibility — does the same setting deliver the same dose each time, or is the output drifting?
• Timer accuracy — a timer that runs long is quietly over-exposing every patient and every operator in range.
• Beam collimation and alignment — the beam should be confined to the area being imaged, not spraying past the sensor.
• Total filtration — adequate filtration removes the low-energy radiation that adds dose without improving the image.
• Leakage radiation — the tube housing should not be leaking beyond permitted limits when the beam is off-axis.

None of these are visible by looking at the machine. They are revealed by measurement, which is exactly why a practice cannot simply assume a unit that produces usable images is compliant. A radiograph can look fine while the timer is off and the dose is well above where it should be.

Operator and patient protection: the parts around the machine

An inspection is not confined to the tube head. It extends to the environment the machine lives in, because radiation protection is as much about distance, shielding and procedure as it is about the device. An inspector will look at whether the operator can stand at a safe distance or behind an adequate barrier during exposure, whether the walls provide the shielding the room’s use requires, and whether warning signs and any required warning lights are present and working.

They will also consider the human side: that the people operating the equipment are qualified to do so, that exposures are ordered appropriately, and that the practice is not exposing patients more than the diagnostic question requires. That last point has become sharper with the profession’s renewed emphasis on scanning in moderation and justifying each exposure. We covered what the updated guidance means for your records and software in our look at why the 2026 imaging guidelines put the burden of justification on your documentation — and an inspector reviewing your practice is reading from the same principle.

The records are what turn an inspection into a formality

Here is the single most useful thing to understand: an inspection is, to a large degree, a review of documentation. The machine’s performance matters, but your ability to demonstrate that it has been maintained, tested and operated correctly is what makes the visit routine. The records that carry the day are predictable:

• Current registration for each machine, matching the equipment actually in use.
• A designated responsible person — someone accountable for radiation safety in the practice, not a vacancy no one has filled since the last staff change.
• Quality-assurance and service records showing periodic testing and maintenance by qualified providers, with dates and results.
• Operator qualifications on file for everyone who takes radiographs.
• Procedures and logs that show exposures are ordered and recorded appropriately.

This is the same discipline that protects a practice everywhere else its critical systems live. The habit of keeping a current inventory, a named owner and a dated maintenance log is exactly what we recommend for the practice management server in our backup, patch and access checklist. Radiation equipment is simply another regulated system that rewards the same methodical record-keeping — and punishes its absence.

Preparing before the inspector calls

You do not need to wait for a notice to get ready. A short internal review, done once and then kept current, removes almost all of the stress:

• Confirm every machine is registered and that the registration reflects the current equipment, location and owner. Reconcile any swaps or additions that were never recorded.
• Locate your most recent QA and service reports. If you cannot remember the last time the units were tested, that is the finding an inspection will make for you — book the testing now.
• Name the responsible person in writing and make sure they actually know the role is theirs.
• Walk the operatories as if you were the inspector: barriers, distances, warning lights, signage, and whether operators can protect themselves during every exposure.
• Tidy the logbook. One organised binder or digital folder with registration, QA results, service history and operator credentials answers most of what an inspection asks.

The practices that have a bad inspection are rarely the ones with bad equipment. They are the ones who treated a regulated radiation source as ordinary office hardware, never updated the registration after a change, and could not produce a single quality-assurance report. The equipment itself is usually fine. The paperwork is what fails. And unlike a drifting timer, missing records are entirely within your control to fix before anyone knocks.

Radiation safety also does not end at the operatory door — the moment a 3D scan leaves the building, the concern shifts from dose to data. We covered that side in our guide to sharing a CBCT scan for a second opinion without exposing the patient’s record, because a modern imaging practice has to satisfy both the radiation regulator and the privacy one.

How Compudent can help

Compudent Systems works with dental practices across the GTA and Ontario to keep the technology side of radiation compliance in order — the part that lives in records, systems and process rather than in the clinical judgement that is yours. We help you confirm machine registrations are current and reconciled with the equipment you actually run, organise quality-assurance and service documentation so it is ready the moment it is asked for, maintain the inventory and logs the HARP Act expects, and connect your imaging hardware to the secure storage and sharing your practice relies on. If you are not confident your X-ray documentation would survive an inspection today, contact us for a radiation-equipment IT and records review before an inspector does it for you.

Sources & further reading:

• Healing Arts Radiation Protection Act, R.S.O. 1990 (Ontario e-Laws)
• Health Canada Safety Code 30: Radiation Protection in Dentistry
• Radiation machine inspections in the dental office: what to expect, how to prepare

Related Reading

• The Evolution of X-ray Technology in Dentistry: What Dental IT Professionals Need to Know
• One Screen for Scans and X-Rays: What Medit’s AuraVue With Overjet AI Means for Your Dental Practice
• The ADA Now Says Scan Less — So Your Records Have to Say Why: What the 2026 Imaging Guidelines Mean for Your Practice Software

The post What a Dental X-Ray Inspection Actually Checks — and How Ontario Practices Prepare Under the HARP Act appeared first on Compudent Systems.

The short answer is that Teams can be. The longer answer, which is the one that matters for your practice, is that it is compliant only when it is configured for it and backed by the right signed agreement. Left at its defaults, or used on the wrong account, the same tool quietly becomes a place where protected health information travels without any of the protections the law assumes.

What the law counts as patient information

Under HIPAA in the United States and PHIPA here in Ontario, protected health information is not limited to charts and radiographs. A message that ties a person to their care — “call Mrs. Anderson about her crown prep,” “the Patel family both cancelled their cleanings,” “patient in op 3 is the insurance dispute” — is health information about an identifiable individual. The moment that sentence lives in a chat thread, it is a record, subject to the same duties of confidentiality, security and retention as anything in your practice management system.

This is the gap that trips up good teams. Nobody set out to put patient data into a chat tool. It happens because chat is where the work gets coordinated, and a name is the fastest way to be understood. But the privacy rules do not have a casual-conversation exemption, and a regulator reviewing a complaint will not treat a Teams message any differently from a letter.

The signed agreement you may not have

Here is the single most common failure. For a cloud service to lawfully handle protected health information on your behalf, you need a business associate agreement (the HIPAA term; PHIPA frames the same relationship as a written agreement with an agent or service provider). Microsoft will enter into one covering Teams and the rest of Microsoft 365 — but only under the appropriate business and enterprise subscriptions, and only when it is actually accepted as part of your tenancy’s terms.

A practice running patient coordination through a personal Microsoft account, a free Teams tier, or a consumer plan has no such agreement in place. In that situation the compliant version of the platform is not the one you are using, and no amount of careful behaviour by staff closes that gap. This mirrors the problem we described with staff reaching for consumer AI tools: as we covered in how one spreadsheet uploaded to the wrong tool became a patient-data breach, the issue is rarely malice — it is patient data landing in a service that was never bound to protect it.

Configuration is where compliance actually lives

Having the right subscription and a signed agreement is the entry ticket, not the finish line. Teams on a compliant Microsoft 365 tenant still has to be set up deliberately. The settings that matter most for a dental practice are the ones no one looks at after the initial rollout:

• Retention and deletion. Chat messages persist by default. Decide, as a policy, how long messages are kept and when they are purged, so patient information is not accumulating indefinitely in a channel history that keeps growing.
• Guest and external access. Can people outside your organisation be added to a chat or channel? If external guest access is open, a misdirected invite can expose an entire thread. Lock it down to what the practice genuinely needs.
• Encryption and data handling. Confirm data is encrypted in transit and at rest, and consider data-loss-prevention rules that flag or block obvious identifiers from leaving approved channels.
• Audit logging. Compliance assumes you can show who accessed what. Logging must be turned on and retained, not left off because no one enabled it.
• Account hygiene. Who still has access after they leave? Departed staff with lingering accounts are a standing exposure.

The bigger risk: the tools that were never sanctioned at all

Teams at least can be made compliant. The sharper danger in most offices is the messaging that happens entirely outside it — a receptionist texting an appointment reminder with clinical detail from a personal phone, a WhatsApp group the hygienists use to swap patient notes, a quick SMS to the dentist’s cell about a case. None of those channels is covered by any agreement, logged, or recoverable, and they often run on devices the practice does not control.

That personal-device angle is its own exposure, and it is why a messaging policy and a device policy have to be written together. We laid out the device side in our guide to treating the phone in a staff member’s pocket as a PHI device; the messaging policy is the other half of the same control. The rule a practice can actually enforce is simple to state and harder to live by: patient-identifying information moves only through approved, agreement-backed channels, and never through a personal texting or chat app.

A practical check for this week

• Confirm your plan. Verify your Microsoft 365 subscription is a business or enterprise tier that supports a business associate agreement — and that the agreement is actually in place, not assumed.
• Review the Teams settings for retention, guest access, encryption and audit logging rather than trusting the defaults.
• Write the rule down. A short, plain-language policy on where patient information may and may not be discussed, trained into every staff member, is worth more than any single setting.
• Close the side channels. Identify the personal texts and consumer apps already carrying patient details and give staff a compliant alternative, because a ban with no replacement never holds.
• Keep access current. Audit who can reach your chat history, and remove accounts for anyone who has left. Our access and backup checklist covers the same discipline for the practice management server.

Microsoft Teams is not the problem, and you do not need to abandon it. What the 2026 compliance updates keep underlining is that the default, out-of-the-box version of any collaboration tool is not the compliant one — compliance is a configuration and a signed agreement, deliberately put in place and maintained. The practices that get caught out are not the ones using Teams; they are the ones who assumed that because everyone uses it, it must already be safe for patient information.

How Compudent can help

Compudent Systems helps dental practices across the GTA and Ontario use the collaboration tools they already rely on — Microsoft Teams, Microsoft 365, messaging and email — without turning everyday coordination into a privacy breach. We confirm your subscription supports and includes the right business associate agreement, configure Teams for retention, access, encryption and audit logging, and help you write and roll out a messaging policy that staff can actually follow, all aligned to PHIPA obligations rather than generic hospital IT. If you are not certain whether the chat where your team coordinates patient care is compliant, contact us for a Microsoft 365 and messaging compliance review.

Sources & further reading:

• Is Microsoft Teams HIPAA Compliant? 2026 Update
• HIPAA Updates and HIPAA Changes in 2026
• Microsoft 365 and HIPAA Business Associate Agreement guidance

Related Reading

• Can Your Dental Practice Use ChatGPT Without Breaking HIPAA and PHIPA? A 2026 Compliance Guide
• MFA, Encryption, 72-Hour Restore: Washington’s HIPAA Overhaul Is a Preview of the New Security Floor for Every Dental Practice
• PHIPA, HIPAA, and Dental AI: PHI, Data Governance, and Vendor Risk

The post Is Your Practice Discussing Patients in Microsoft Teams? What HIPAA and PHIPA Actually Require in 2026 appeared first on Compudent Systems.

For a lot of practices, that storage box is not an afterthought. It is the backup. It may also hold imaging archives, scanned documents and a shared drive full of patient files. When the device that was supposed to be your way out of a ransomware incident becomes the device that gets encrypted, the whole recovery plan quietly inverts.

What is actually happening

Security researchers and Synology itself have been tracking a ransomware strain — reported under names including C3RB3R, a variant in the long-running Cerber family — that targets Synology NAS appliances reachable from the internet. The common thread in the compromised devices is unpatched, out-of-date DSM firmware. Sources disagree on the exact entry point: Synology has pointed to a weakness it patched some time ago on devices that were never updated, while other researchers tie the intrusions to more recent critical DiskStation Manager flaws (tracked as CVE-2026-13639 and CVE-2026-13684) that Synology fixed in a 2026 advisory. Some analyses also note add-on packages, containers and stolen credentials as possible paths in.

The disagreement over the precise vulnerability matters less than the pattern, which is consistent across every account: the devices getting hit are exposed to the open internet and behind on updates. That is a configuration a surprising number of small offices fall into without realising it.

Why this lands so hard on a dental practice

Dental offices adopted NAS boxes for good reasons. They are an affordable way to store large imaging files, run a shared drive, and — crucially — hold backups of the practice management server. The problem is that a single NAS often ends up doing all three jobs at once: it is the live file store and the backup target, sitting on the same network, powered on and reachable twenty-four hours a day.

Ransomware authors know this. The modern playbook is explicitly to find and destroy backups first, because a practice that can restore cleanly never has to pay. When your backup lives on an always-connected NAS that is also exposed to the internet, you have handed the attacker both targets in one device. That is the same hard lesson behind the sharp rise in healthcare ransomware we tracked through 2026: the groups hitting medical and dental data are methodical, and they go after recovery capability on purpose.

The two changes that close the door fastest

If you run a Synology — or any — NAS, two actions address the immediate risk, and you should treat them as this week’s priority, not next quarter’s project.

1. Update the firmware now. Log in to DSM and install the latest DiskStation Manager update and any security patches. The practices being encrypted in this campaign are overwhelmingly the ones running old firmware; applying the current update removes the specific flaws the attackers are using. If you are not sure how to check your DSM version or do not have a maintenance login, that is exactly the kind of gap worth closing with help rather than guesswork.

2. Get the NAS off the open internet. Ask one blunt question: can this device be reached from outside the office? If staff or a vendor set up remote access — a forwarded port, Synology QuickConnect, or a login page you can open from home — the NAS is exposed, and that exposure is what turns a patchable flaw into an active breach. Remote access to internal storage should run through a VPN or a properly secured gateway, never a port pointed straight at the storage box. Open remote-access doors are a recurring theme in real incidents; we have written before about how exposed remote access keeps being the way into dental networks, and an internet-facing NAS is the same mistake wearing different clothes.

Why patching the NAS is still not a backup strategy

Here is the uncomfortable part. Even a fully patched NAS is not, by itself, a safe backup. If ransomware gets onto a workstation through some other route — a phished credential, a compromised laptop — and your NAS is a mapped, always-connected drive, the malware can encrypt everything on it exactly as it encrypts the local disk. Patching stops this campaign’s entry point; it does not change the fact that an online, reachable backup is a backup within the blast radius.

The fix is an old rule that keeps proving itself: the 3-2-1 approach — at least three copies of your data, on two different types of media, with one copy kept offline or immutable and out of the network’s reach. An offline copy is one that is physically disconnected or stored on media that cannot be altered or deleted for a set retention window. That is the copy ransomware cannot touch, because there is nothing for it to connect to. We walk through what sound backup and access controls look like on the practice management side in our Dentrix server backup, patch and access checklist, and the same principle applies to every device that holds patient data.

A short checklist for this week

• Patch DSM (or any NAS firmware) to the current release today, and turn on automatic security updates.
• Confirm the NAS is not reachable from the internet — check for forwarded ports, QuickConnect and any remote-login feature, and disable them in favour of VPN access.
• Verify you have an offline or immutable backup copy that is not a permanently connected drive or share.
• Actually test a restore. A backup you have never restored from is a hope, not a plan.
• Prioritise using a trusted list. If you are unsure what to fix first across all your devices, the CISA Known Exploited Vulnerabilities catalogue is a free way to rank what attackers are using right now.

The Synology campaign will eventually fade from the headlines, as these always do. What it exposes is permanent: the storage device holding your patient images and your backups is a networked computer that attackers will target precisely because it is where recovery lives. Treat it like the critical asset it is — patched, off the open internet, and backed by a copy nothing on your network can reach.

How Compudent can help

Compudent Systems helps dental practices across the GTA and Ontario make sure the devices holding patient data are not the weak point in a ransomware incident. We review how your NAS and backup appliances are configured, close off internet exposure, keep firmware patched, and design a 3-2-1 backup with a genuinely offline or immutable copy that survives an attack — all tuned to PHIPA obligations and the realities of a dental office rather than a hospital IT department. If you are not certain whether your backup could be encrypted along with everything else, contact us for a backup and storage assessment before an attacker tests it for you.

Sources & further reading:

• Synology Security Advisory and C3RB3R ransomware guidance
• Synology warns ransomware is exploiting outdated DSM installations
• CVE-2026-13639 – Synology DiskStation Manager (DSM) vulnerability

Related Reading

• The "Recovery" Firm Was Secretly Paying the Ransom: Why an Immutable, Air-Gapped Backup Is the Only Exit Your Dental Practice Controls
• Dental Practices Under Siege: The Rising Threat of Ransomware Targeting Healthcare Data
• Your Backups Are Only as Good as Your Last Test Restore: A Dental Practice Reality Check

The post Ransomware Is Now Hunting Your Backup NAS: The Synology Attacks and What Dental Practices Must Do appeared first on Compudent Systems.

For years, device provenance was treated as a procurement detail somewhere below price and image quality. It is now a security question, and governments are starting to treat it as one. A dental office does not need a state mandate to take the same prompt seriously — it just needs to understand why the conversation changed.

Why governments are suddenly auditing where devices come from

A modern medical or dental device is not a passive instrument. It is a small networked computer: an X-ray sensor, an intraoral scanner, a cone-beam CT unit, or a vitals monitor, each running an embedded operating system and firmware, each capable of reaching out across your network and, in many cases, out to the internet for "updates," telemetry or cloud features.

That capability is useful. It is also a channel. When the people who wrote a device’s firmware are outside your jurisdiction, outside your vendor contracts, and potentially subject to a foreign government’s data-access laws, the device becomes a question of trust that no amount of image resolution answers. State-level reviews like the one reported in Texas are simply formalising that concern for public agencies. The underlying risk is identical for a private dental practice — it just does not come with a press release.

The backdoor that made this real: the Contec monitor case

This is not hypothetical. In early 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an advisory on the Contec CMS8000, a widely used, Chinese-manufactured patient monitor. Researchers found the device contained a hidden backdoor: it quietly sent patient data to, and could pull instructions from, a hard-coded remote address — behaviour no hospital had configured, consented to, or could see.

That is the shape of the modern supply-chain risk. The device did its clinical job perfectly while doing something else entirely in the background. You cannot spot that by looking at the images it produces or the box it shipped in. It lives in the firmware, and it travels with the hardware. We have written before about why device provenance is now a dental practice security question, and the Contec case is the clearest proof yet that the worry is grounded in real findings, not speculation.

Your dental imaging hardware is part of this conversation

Dentistry runs on connected devices. Digital radiography sensors, panoramic and cone-beam CT units, intraoral scanners and milling units all sit on the practice network, and a growing share of them are manufactured — in whole or in part — overseas, often in China, regardless of the Western brand on the label. That is not an accusation against any one manufacturer; it is simply the reality of a global hardware market.

The point is not to panic or to rip out working equipment. It is to recognise that every one of those devices handles protected health information under HIPAA and personal health information under Ontario’s PHIPA, and that each one is an endpoint whose software you did not write and cannot fully inspect. They belong in your risk assessment alongside your servers and workstations — a surface we covered in our look at the connected-device attack surface in a dental practice.

The questions to ask before you buy — and keep asking

Provenance belongs on the purchase order, not in the post-incident report. Before you acquire a new imaging device — and when you review the ones you already run — put these questions to the vendor and get the answers in writing:

• Where is the device and its firmware actually manufactured and maintained? "Designed in" is not "built in," and the firmware’s authorship matters more than the logo.
• Does it meet current regulatory cybersecurity requirements? In the U.S., newer devices must satisfy the FDA’s Section 524B premarket cybersecurity rules — a useful bar even for Canadian buyers. Our note on FDA 524B and dental imaging purchasing explains what to look for.
• What does it connect to, and can that be turned off? Ask for a list of the external addresses and services the device contacts, and whether cloud or telemetry features can be disabled without breaking clinical function.
• Who ships security updates, how often, and for how long? A device that will stop receiving firmware patches in two years is a liability with a countdown on it.
• Is there a Software Bill of Materials (SBOM)? Reputable manufacturers can now provide one — a list of the components inside the firmware, which is how known vulnerabilities get found before attackers find them.

What to do about the devices already on your network

You almost certainly cannot replace every device whose provenance you are unsure of, and you do not need to. The practical defence is containment: assume any connected device could misbehave, and build the network so that it cannot reach anything it has no business reaching.

That means segmenting imaging and clinical devices onto their own isolated network, away from your general workstations, email and internet browsing, so a compromised device is boxed in rather than handed the keys to the practice. It means restricting outbound connections at the firewall so a device phoning home to an unexpected address is blocked and logged. And it means watching the traffic — a device that suddenly starts talking to a server it never contacted before is exactly the signal you want to catch. This is the discipline we laid out in our guide to segmenting legacy imaging devices, and it protects you regardless of where any individual device was made.

The state review making headlines will run its course. The lesson for a dental practice outlasts the news cycle: the devices you trust with patient images are computers you did not build, and provenance, patch support and network containment are now part of buying and running them responsibly.

How Compudent can help

Compudent Systems helps dental practices across the GTA and Ontario bring imaging and clinical devices into a sound security posture: provenance and vendor-risk review before you buy, network segmentation that isolates imaging hardware, firewall rules that catch a device talking where it should not, and monitoring that fits a dental office rather than a hospital IT department. If you are not sure what your imaging devices are connected to — or where they were made — contact us for an assessment, and we will help you answer those questions before someone else does.

Sources & further reading:

• Texas orders cybersecurity review of state agencies’ Chinese-made medical devices
• CISA ICS Medical Advisory ICSMA-25-030-01: Contec CMS8000 patient monitor backdoor
• FDA: Cybersecurity in Medical Devices (Section 524B premarket requirements)

Related Reading

• Where Was Your Imaging Sensor Made, and What Is It Talking To? Device Provenance Is Now a Dental Practice Security Question
• One Screen for Scans and X-Rays: What Medit’s AuraVue With Overjet AI Means for Your Dental Practice
• Medtronic Data Breach by ShinyHunters: Critical Warning for Medical Device Security in Dental Practices

The post A State Just Started Auditing Chinese-Made Medical Devices: What It Means for Your Dental Imaging Hardware appeared first on Compudent Systems.

The honest answer in most practices is "nobody." The practice server gets patched, backed up and locked down. The personal iPhone a hygienist uses to photograph a case, text a patient a reminder or approve a two-factor login sits entirely outside that discipline. That gap is now one of the most overlooked risks in a modern office.

Why the phone in a staff member’s pocket is now a PHI device

A decade ago, patient data lived on practice-owned computers bolted to a desk. Today it leaks onto mobile devices in a dozen quiet ways: a team member snaps an intraoral photo on their own phone, a front-desk staffer texts appointment details from a personal number, a dentist checks the schedule or a portal message from home, or a staff phone holds the authenticator app that unlocks your cloud imaging and practice-management logins.

Each of those is protected health information under HIPAA and personal health information under Ontario’s PHIPA. The device holding it does not stop being your responsibility just because the practice did not buy it. If that phone is lost, stolen, sold without wiping, or compromised, it is a reportable privacy breach — the same as if the data had walked out of your server room.

The "SMS of Death" and what unpatched devices really cost you

The newly disclosed Android exploit only works against devices that have not installed current security updates. That is the real lesson, and it is not limited to one flaw: an unpatched phone is a standing liability. Mobile operating systems ship security fixes almost every month, yet personal devices routinely run months or years behind, especially budget Android handsets that stop receiving updates entirely.

In a practice, an out-of-date device is the same category of problem as an out-of-date server or an exposed remote-access service. We have written before about how attackers keep walking in through neglected remote access, and about the way threats now reach down to the firmware of the machines you rely on. A phone with a known, unpatched flaw is simply one more unlocked door — one that travels home every night.

BYOD versus practice-owned: two models, one policy

There are two legitimate ways to handle mobile devices, and most offices drift into a messy third option by accident.

Practice-owned devices give you the most control. The office buys the tablets and phones, owns them outright, and can enforce whatever security settings it likes. This is the cleanest model for devices that routinely capture images or handle PHI.

Bring your own device (BYOD) lets staff use their personal phones, which is cheaper and more convenient — but only works safely with clear rules and a technical boundary between work and personal data.

The dangerous third option is "BYOD by default": no policy, no boundary, staff simply using whatever they have. That is where almost every mobile privacy breach begins. Choosing a model and writing it down is the entire point.

What a workable mobile device policy actually contains

A mobile device policy does not need to be a legal treatise. For a dental practice it needs to answer a short list of practical questions in plain language:

• Which devices are allowed to access practice data, email, or imaging — and which are explicitly not.
• Baseline security requirements: a passcode or biometric lock, automatic screen lock, device encryption on, and current security updates installed.
• No patient photos on the camera roll. Clinical images belong in your imaging system, not mingled with a staffer’s personal photos and cloud backup. Approved capture apps that upload directly and leave nothing behind are the goal.
• How patients are contacted: texting from personal numbers is a common and avoidable leak. Route patient messaging through the practice’s system.
• Lost or stolen device reporting: who to tell, how fast, and the expectation that the device can be remotely wiped.
• Offboarding: what happens to practice data and access when an employee leaves.

Have every team member read and sign it. A signed policy is both a genuine control and part of the documentation a regulator will ask for after an incident.

Mobile device management: the control layer most practices skip

A policy on paper tells people what to do. Mobile device management (MDM) actually enforces it. MDM is software — Microsoft Intune, Jamf for Apple devices, and similar tools — that lets you set rules centrally and apply them to every enrolled phone and tablet.

The capability that matters most for BYOD is the managed work profile, or work container. It carves a device into two separated worlds: the employee’s personal apps and photos on one side, and a contained work area — practice email, imaging apps, logins — on the other. You can enforce a passcode, require encryption, and remotely wipe only the work side if the device is lost or the employee leaves, without ever touching their personal data. That single feature removes the biggest objection staff have to BYOD and the biggest risk the practice carries.

MDM also gives you something you almost certainly lack today: visibility. A simple dashboard shows which devices are enrolled, which are behind on updates, and which have fallen out of compliance — the mobile equivalent of the server-side discipline in our backup, patch and access checklist.

A starting checklist for Monday morning

You do not need to solve this all at once. Start here:

1. Inventory. List every phone and tablet that touches practice email, imaging, portals, or authenticator apps — personal devices included.
2. Enforce the basics today. Confirm every one of those devices has a passcode, automatic lock, encryption enabled, and current updates installed.
3. Stop the obvious leaks. No clinical photos on personal camera rolls; no patient texting from personal numbers.
4. Write and sign a one-page policy covering the questions above.
5. Plan for MDM. Decide whether your PHI-handling devices should be practice-owned or managed work profiles on personal phones, and roll out an MDM tool to enforce it.

The practices that get breached through mobile devices are rarely unlucky — they simply never decided who owned the problem.

How Compudent can help

Compudent Systems helps dental practices across the GTA and Ontario bring mobile devices into the same security posture as the rest of the office: a practical BYOD policy, Intune or Jamf-based mobile device management, work-profile separation, and update and encryption enforcement that satisfies HIPAA and PHIPA expectations. If the phones and tablets in your office have never appeared in your security plan, contact us for an assessment — we will help you close the gap before it becomes a breach report.

Sources & further reading:

• New Android ‘SMS of Death’ exploit can remotely crash unpatched phones
• August 2026 Healthcare Data Breach Report

Related Reading

• Can Your Dental Practice Use ChatGPT Without Breaking HIPAA and PHIPA? A 2026 Compliance Guide
• Is Texting or Emailing Your Patients a PHIPA and HIPAA Violation? Secure Patient Communication for Dental Practices
• Wireless Medical Device Vulnerabilities Expose Dental Practices to Man-in-the-Middle Attacks

The post The Phone in a Staff Member’s Pocket Is Now a PHI Device: A Mobile Device Policy for Dental Practices appeared first on Compudent Systems.

What actually happened

A VPN appliance like Ivanti Connect Secure sits at the edge of a network and exists to let authorized people in from the outside — a staff member working from home, a doctor checking a schedule, an IT contractor doing remote maintenance. Because it is exposed to the internet by design, it is also one of the most attractive things on the network to attack. Volexity found that an attacker group chained three separate bugs: the first flaws let them run code on the appliance without ever logging in, and a final privilege-escalation flaw lifted that foothold all the way to root — total administrative control. “Unauthenticated” is the word that matters: no stolen password, no phishing, no insider. A device reachable from the internet was enough.

Why “fully patched” did not save them

The detail that unsettles seasoned administrators is that the targeted appliances were up to date. These were zero-days — flaws the vendor did not yet have fixes for when the attacks began. That is a reminder that patching, while essential, is not a force field. There is always a window between when attackers find a flaw and when a fix exists, and skilled groups live inside that window. It is the same uncomfortable trend we covered when AI-assisted exploit development began shrinking the time a practice has to patch. The takeaway is not to stop patching — it is to stop assuming the edge device is safe simply because it is current, and to build defenses that hold up even during that exposure window.

Why a rooted VPN is close to a worst-case breach

When an attacker compromises a single workstation, they have one workstation. When they gain root on the VPN appliance, they hold the device that all remote access flows through. From there they can watch and redirect traffic, harvest credentials as staff log in, and reach straight into the internal network the VPN was protecting — the practice-management server, imaging storage, and the patient records they hold. Worse, this attack was built to be silent, deploying nothing that would trip an alarm. That combination — deep access plus no visible trace — is exactly the quiet, long dwell time that turns a single flaw into a reportable breach of protected health information. It is the same lesson as recent attacks that target the perimeter device itself rather than the users behind it: compromise the gatekeeper, and everything it guards is exposed.

“But we’re just a dental office” — why you’re in scope

It is tempting to file nation-state-grade VPN exploits under someone else’s problem. They rarely stay that way. Once a flaw like this is public, the technique is reused by ordinary criminal groups within days, and automated scanners sweep the entire internet looking for any exposed appliance — a practice’s VPN answers those scans exactly as a hospital’s does. Attackers are not choosing you by name; they are choosing every reachable, unpatched gateway they can find, and a dental network holds something they can monetize: patient data and the leverage to freeze your schedule. Many practices stood up remote access quickly in recent years and have not revisited it since, which is precisely the kind of set-and-forget device these campaigns hunt for. The same remote-access doors keep showing up as the way in, a pattern we traced in this year’s dental ransomware breaches.

What to do this week

You do not need an enterprise security team to respond sensibly. You need a short, disciplined routine:

• Find out what VPN or remote-access appliance you run, and its version. If it is Ivanti Connect Secure, confirm against Ivanti’s advisory whether your version (the disclosure named 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior as affected) is fully covered by the October fixes — and apply them immediately if not.
• Prioritize by what is actually being exploited. This flaw is on CISA’s Known Exploited Vulnerabilities list — the free federal shortlist of bugs attackers are using right now. Anything your practice runs that appears there jumps to the front of the patch queue.
• Get management interfaces off the open internet. The admin page of a VPN, firewall or server should never be reachable from the public internet — restrict it to the local network or a tightly controlled path.
• Require multi-factor authentication on every remote-access account, so a stolen or leaked password alone cannot get someone in.
• Segment the network so imaging devices, the practice-management server and guest Wi-Fi sit in separate zones — if the edge is breached, segmentation limits how far an intruder can travel.
• Protect and test your recovery path. Keep backups isolated and verified, so a silent compromise cannot also destroy your ability to recover — the discipline in our server backup, patch and access checklist.

The real lesson: remote access needs an owner

The uncomfortable message from this disclosure is that the device meant to let your team in safely can be turned into the attacker’s own front door — quietly, without a stolen password, and without leaving the usual traces. The reassuring part is that remote-access security is mostly a management problem, not a budget one. A VPN that is inventoried, patched on a schedule, locked down to trusted access, protected with MFA, segmented, and actually monitored stops being the internet’s easiest target and becomes your network’s strongest point.

If you are not certain what remote-access appliance your practice uses, when it was last updated, or whether its admin interface is exposed to the internet, that uncertainty is the risk. Contact Compudent Systems for a review of your practice’s remote access and network edge: we will identify what is exposed, confirm it is patched and properly locked down, and set up the MFA, segmentation, logging and backup posture that keeps a single flaw from becoming a breach of your patients’ trust.

Sources & further reading:

• The Hacker News — Attacker Chains Three Ivanti Connect Secure Flaws for Unauthenticated Root Access (Volexity; UTA0576)
• Help Net Security — Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances
• Cybersecurity Dive — Hacker chained Ivanti Connect Secure flaws in stealthy exploitation
• CISA — Known Exploited Vulnerabilities Catalog

Related Reading

• The Gateway That Lets Your Team In Can Let Attackers In Too: Critical Check Point VPN Flaws (CVE-2026-85102 / 85103) and Your Practice
• The Way In Was Remote Desktop: What 2026’s Dental Ransomware Breaches Keep Showing Us
• Ransomware Gangs Are Now Through the Front Door: What the SonicWall SMA1000 VPN Attacks Mean for Dental Practices

The post Attackers Rooted Fully-Patched Ivanti VPNs: What the Connect Secure Zero-Day Chain Means for Remote Access in Your Practice appeared first on Compudent Systems.

What “shadow AI” actually means

Shadow AI is any artificial-intelligence tool your practice uses that your practice never vetted, approved, or controls. It is the receptionist pasting a patient’s insurance letter into a free chatbot to “make it sound more professional,” the hygienist using a public transcription app to summarize notes, or the office manager dropping a recall list into a consumer AI to clean up the formatting. None of these people are acting maliciously. They are doing what people have always done with helpful technology — using it. The problem is that the moment protected health information leaves your controlled systems and enters a public AI service, you have lost custody of it, and in most cases you have triggered a reportable breach. The Johns Hopkins incident is simply the most visible example of a pattern playing out everywhere convenience and unmanaged AI tools meet.

Why a dental office is more exposed than a hospital

It is tempting to read a Johns Hopkins headline and assume the lesson is for big institutions. The opposite is true. A large health system at least has acceptable-use policies, security awareness training, and monitoring — and it still got caught. A typical dental practice has none of that scaffolding. Staff wear many hats, deadlines are real, and a free AI tool that turns a tedious task into a thirty-second one is genuinely tempting. There is rarely a written rule that says “do not paste patient information into online tools,” rarely any technical control stopping it, and rarely anyone watching. That combination — high convenience, low governance, zero visibility — is exactly the environment in which shadow AI thrives. The same blind spot shows up in how long intrusions go unnoticed; we have written before about the security metric most practices ignore, and shadow AI is its quiet cousin: a leak you never see happen.

What really happens when PHI goes into a public AI tool

When a staff member uploads patient data to a consumer AI service, several things happen at once, none of them good. First, you almost certainly have no Business Associate Agreement with that provider — the contract HIPAA and Ontario’s PHIPA require before a third party can handle patient information on your behalf. Without it, the disclosure is a compliance violation on its face. Second, many free and consumer AI tools retain your inputs and may use them to train future versions of the model, meaning the data can persist well beyond that one session and outside any boundary you control. Third, you now have an unquantifiable exposure: you cannot say with confidence who can see the data, where it is stored, or how to get it deleted. That uncertainty is itself the breach. The patients at Bayview were notified not because anyone proved the data was misused, but because, once it left for an unapproved tool, the practice could no longer guarantee it was safe. This is the same vendor-scrutiny discipline we urge for clinical AI — the kind laid out in our IT due-diligence checklist for cloud AI imaging tools — applied to the everyday software your staff reach for on their own.

How to find the shadow AI already in your practice

You cannot govern what you cannot see, so the first step is discovery, and it does not require expensive tooling. Start with a conversation, not an accusation: ask your team which online tools they use to speed up writing, summarizing, formatting, or transcription. People are usually happy to tell you once they understand it is about safety, not blame. Then look at the technical layer. A business-grade firewall or network filter can report which cloud and AI services your office network is actually reaching, surfacing tools nobody mentioned. Review browser extensions and any apps installed on practice computers. And pay special attention to the handful of recurring, tedious tasks — insurance appeals, patient letters, recall lists, chart summaries — because those are precisely where a frustrated staff member is most likely to have quietly adopted an AI shortcut.

From ban to governance: giving staff a safe way to use AI

The instinct after a story like this is to forbid AI outright. That almost never works — it just pushes shadow AI further into the dark, onto personal phones and home laptops where you have even less visibility. The durable fix is governance, built on a few practical pieces. Write a short, plain-language acceptable-use policy that states clearly: no patient information, ever, goes into any tool the practice has not approved. Pair the “no” with a “yes” by offering a sanctioned alternative — an enterprise AI service that will sign a Business Associate Agreement and contractually keep your data out of training — so staff are not left choosing between the rules and getting their work done. Add technical guardrails where you can: data-loss-prevention controls and network filtering that flag or block uploads of sensitive data to unapproved destinations. Fold AI into your regular security awareness training, using exactly this kind of real incident to make it concrete. And govern access to AI tools with the same discipline you apply to the rest of your systems — the access-and-review habits we outline in our practice server backup, patch and access checklist.

AI is going to be part of how dental practices work — the question is only whether it happens on your terms or in the shadows. The Johns Hopkins breach is a gift in disguise: a clear, well-documented warning that the newest way to lose patient data is not a sophisticated attack but an ordinary, unmanaged convenience. If you are not sure what AI tools your staff are using, whether any of them have touched patient information, or how to offer a safe alternative, that uncertainty is your exposure. Contact Compudent Systems for a shadow-AI review of your practice: we will help you discover what is in use, set a clear acceptable-use policy, put the right technical guardrails in place, and give your team an approved, compliant way to use AI — so a single helpful upload never becomes a notification letter to your patients.

Sources & further reading:

• Healthcare IT News — At Johns Hopkins, shadow AI use linked to data breach (October 2026)
• WMAR — Johns Hopkins alerts 3,000+ patients after data sent to AI tool (Oct 23, 2026)
• The HIPAA Journal — Is ChatGPT HIPAA Compliant? (Updated for 2026)

Related Reading

• PHIPA, HIPAA, and Dental AI: PHI, Data Governance, and Vendor Risk
• No Malware Required: How an "IDOR" Flaw in Dental Software Exposed Patient Records — and the Questions to Ask Your Vendor
• AI-Powered Security Solutions Transform Dental Practice Data Protection

The post No Hacker Required: How One Spreadsheet Uploaded to the Wrong AI Became a Patient-Data Breach — and the Shadow AI Risk in Your Practice appeared first on Compudent Systems.

The new target is the gatekeeper, not the guests

For years, security advice focused on the computers people use: keep workstations patched, train staff against phishing, protect the practice-management server. That advice still holds. But the firewall, VPN appliance, router and virtualization host that sit between your office and the internet were often treated as set-and-forget hardware — installed once, rarely touched. Attackers noticed. These edge devices are internet-facing by design, they run complex software with their own vulnerabilities, and they are frequently overlooked when it comes to updates. The Palo Alto PAN-OS management interfaces exploited through internet-exposed flaws, the Cisco SD-WAN compromise, and the VMware logging zero-day are all the same story told three ways: the gatekeeper has become the easiest and most valuable thing to attack.

Why a compromised edge device is the worst kind of breach

When an attacker takes over a laptop, they have one laptop. When they take over the device that all your traffic flows through, they have a position above everything. From there they can read or redirect network traffic, harvest credentials as staff log in, and — as the KeyDrift malware shows — steal the very encryption keys that were supposed to keep that traffic private. Worse, these compromises are designed to be silent. The VMware ESX attack specifically targeted logging so defenders would have less to investigate. An edge-device breach can therefore sit undetected for months, which is exactly the kind of long, quiet dwell time that turns a small incident into a reportable breach of patient data. Encryption and firewalls give a comfortable sense of safety; an attacker living inside the device that provides them quietly erases that safety without tripping an alarm.

“But we’re just a dental office” — why you’re squarely in scope

It is tempting to assume nation-state tooling and enterprise-gear exploits have nothing to do with a six-operatory practice. They do. Most of these flaws are weaponized, published, and then reused by ordinary criminal groups within days — and automated scanners sweep the entire internet looking for any unpatched device, not just big ones. A practice’s firewall or VPN gateway responds to those scans exactly like a hospital’s does. In fact, smaller offices are often more exposed, because the edge device was set up once by whoever installed the internet connection and has not been reviewed since. Attackers are not choosing you personally; they are choosing every unpatched gatekeeper they can find, and a dental network holds something they can monetize: protected health information and the leverage to shut your schedule down.

What actually lives at your network’s edge

Before you can protect the edge, you have to know what is on it. In a typical practice, the internet-facing and privileged devices usually include the firewall or security gateway, any VPN appliance used for remote access, the router or modem from your provider, any remote-access or remote-management tool (a recurring entry point — see our look at how remote desktop keeps turning up as the way attackers get in), a network-attached backup or NAS, and — if you run virtualized servers — the hypervisor management interface. Each of these is a small computer running software that needs updates. A consumer-grade box is especially risky here, which is why we have argued that a consumer router is not a firewall for a practice handling patient data. The goal of an inventory is simple: no device at your edge should be a surprise, and none should be running software the vendor stopped supporting.

A practical hardening checklist for your practice

You do not need an enterprise security team to close most of this exposure. You need a short, disciplined routine:

• Patch the edge first. Firewall, VPN, router and hypervisor firmware should be updated on a schedule, prioritizing anything on CISA’s Known Exploited Vulnerabilities list — the free federal shortlist of flaws attackers are using right now.
• Get management interfaces off the open internet. The admin page of a firewall, VPN or hypervisor should never be reachable from the public internet. Restrict it to the local network or a controlled VPN, which neutralizes a whole category of the attacks described above.
• Turn on multi-factor authentication for remote access and device administration, so a stolen password alone cannot unlock the gatekeeper.
• Segment the network so imaging devices, the practice-management server and guest Wi-Fi sit in separate zones. If the edge is breached, segmentation limits how far an intruder can move.
• Keep and watch the logs. Because attackers now target logging specifically, store edge-device logs somewhere they cannot easily erase, and have someone actually review alerts.
• Protect the recovery path. Make sure backups are isolated and tested, so a silent compromise cannot also destroy your ability to recover — the discipline we lay out in our server backup, patch and access checklist.

Turning your most exposed point into your best-defended one

The uncomfortable lesson from this month’s disclosures is that the device meant to protect your network can become the one that betrays it — quietly, by stealing keys and erasing its own tracks. The reassuring part is that edge security is largely a management problem, not a budget problem. A gatekeeper that is inventoried, patched on a schedule, locked down to trusted access, segmented, and monitored stops being the internet’s easiest target and becomes your network’s strongest point.

If you are not certain when your firewall, VPN or server host was last updated — or whether its management interface is exposed — that uncertainty is the risk. Contact Compudent Systems for a review of your practice’s network edge: we will inventory what is exposed, confirm it is patched and properly locked down, and set up the segmentation, logging and backup posture that keeps a single flaw from becoming a breach of your patients’ trust.

Sources & further reading:

• The Hacker News — Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys (CVE-2026-20127; KeyDrift; Cisco Talos, October 28, 2026)
• The Hacker News — China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility (CVE-2026-41709; Warp Panda)
• CISA — Known Exploited Vulnerabilities Catalog

Related Reading

• A Consumer Router Is Not a Firewall: Why Your Dental Practice Needs Business-Grade Network Security
• Attackers Rooted Fully-Patched Ivanti VPNs: What the Connect Secure Zero-Day Chain Means for Remote Access in Your Practice
• Ransomware Gangs Are Now Through the Front Door: What the SonicWall SMA1000 VPN Attacks Mean for Dental Practices

The post When the Firewall Itself Is the Backdoor: Why Attackers Now Target the Device Guarding Your Practice Network appeared first on Compudent Systems.

What the KEV catalog actually is

CISA’s Known Exploited Vulnerabilities (KEV) catalog is a running list of software flaws that attackers are confirmed to be exploiting in the real world, right now. That last part is what makes it different from every other vulnerability feed. A vulnerability is only added to the KEV catalog when there is concrete evidence of active exploitation — not because it could theoretically be dangerous, but because someone is already using it to break into systems. The catalog grew out of a 2021 federal directive (BOD 22-01) that ordered government agencies to fix KEV-listed flaws on a deadline, and it has since become the single best public shortlist of what the attacking world is leaning on. It is free, it updates several times a week, and anyone — including a two-operatory dental office — can read it.

Why “just patch everything” quietly fails a practice

In a single monthly Microsoft update cycle, hundreds to well over a thousand vulnerabilities can be disclosed at once; we covered one such record Patch Tuesday and what it meant for dental practices earlier this month. Add the flaws in your imaging software, your network appliances, your website and every third-party plug-in, and the annual total runs into the tens of thousands. A busy practice with no full-time IT staff cannot triage all of that by severity score alone — and it turns out severity scores are a poor guide anyway. Most high-severity vulnerabilities are never exploited at all, while some that look moderate on paper become the entry point for a breach.

Patching strictly “worst-first” by score means you spend scarce time on issues no one is attacking while a flaw that is being weaponized sits untouched. The KEV catalog inverts that: it tells you which ones have already crossed from theoretical to real.

What is on the list right now — and why it is aimed at you

The flaws CISA has added in recent weeks are not exotic. They cluster in exactly the places a dental practice is exposed: internet-facing remote-access gateways and VPN appliances, the web servers behind patient portals and booking pages, and widely deployed software components. The October 26 additions included a memory-corruption flaw in PHP (CVE-2026-109618) — the same family of web-server vulnerabilities we warned about when PHP flaws put practice websites and portals at risk. Recent weeks also brought actively exploited bugs in remote-access and firewall products from major vendors.

If your practice has a VPN for after-hours access, a firewall at the edge, or a website with any kind of login, the KEV catalog is describing your attack surface, not someone else’s data center.

From “known exploited” to a locked practice in days

The reason KEV listing deserves your attention is speed. Once a vulnerability is publicly confirmed as being exploited, criminal groups fold it into their toolkits within days — and healthcare is a favored target, with ransomware against the sector surging through 2026. The most common breach stories are not clever, bespoke hacks; they are an attacker scanning the internet for one of these known, already-exploited flaws on an unpatched edge device, walking in, and encrypting the practice.

A KEV entry is effectively a countdown clock. The flaws on that list are the ones being sprayed across the internet looking for a practice that has not gotten to them yet.

How a dental practice can actually use it

You do not need a security team to put the KEV catalog to work. A practical routine looks like this. First, know what you expose: keep a short inventory of anything internet-facing (firewall, VPN or remote-access gateway, website, patient portal) and the core clinical software versions you run. Second, watch the list: subscribe to CISA’s free alerts so new KEV additions land in an inbox you check. Third, cross-reference: when a product you use appears on the KEV catalog, that patch jumps the queue ahead of everything else, regardless of its severity score. Fourth, set a deadline: give KEV-listed items a firm remediation window — the federal standard is roughly two weeks, and faster is better for anything at the network edge.

Finally, write it down, because this is also a compliance record: under PHIPA, demonstrating a reasonable, risk-based patching process matters, and “we prioritize vulnerabilities under active exploitation” is exactly that. If you already run a disciplined routine like our server backup, patch and access checklist, the KEV catalog simply tells you where to point it first.

You should not have to watch the list alone

The KEV catalog is powerful precisely because it is simple — but it only helps if someone is reading it against an accurate picture of your systems, week after week, and acting before the countdown runs out. That is the kind of quiet, continuous work that keeps a practice off the breach reports, and it is easy to let slide when you are running a clinic. If you are not certain which of your systems are internet-facing, whether your remote-access and firewall appliances are current, or how your practice would even know when a flaw you rely on lands on the KEV list, contact Compudent Systems for a vulnerability and patch-prioritization assessment. We will map your exposure, line it up against what is actually being exploited, and make sure the patches that matter most get done first.

Sources & further reading:

• CISA — Known Exploited Vulnerabilities Catalog
• CISA — Adds Two Known Exploited Vulnerabilities to Catalog (October 26, 2026; CVE-2026-109618 PHP)
• CISA — BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities

Related Reading

• October 2026 Patch Tuesday: Microsoft Fixes a Record 1,400+ Flaws and an Exploited Windows Zero-Day — What Dental Practices Must Patch Now
• 974 Patches, Two Being Exploited Right Now: How a Dental Practice Should Read September’s Patch Tuesday
• Critical FortiClient EMS Zero-Day CVE-2026-35616 Actively Exploited: Urgent Security Alert for Dental Practices

The post The Free Federal List That Tells Your Dental Practice What to Patch First: Making Sense of CISA’s KEV Catalog appeared first on Compudent Systems.

This is not a monthly patch notice. It is an end-of-life milestone, and it is the kind of change that costs nothing on the day it happens and a great deal later. Here is what actually ended, what is ending next, and the practical steps a practice should take now.

What just ended, in plain terms

Windows Server 2012 and 2012 R2 reached the end of Microsoft’s normal support back in October 2023. After that, the only way to keep getting security patches was a paid, year-by-year program called Extended Security Updates (ESU) — a deliberate three-year runway for organizations that could not move off the old platform right away. That runway had a hard end. Year three concluded with the October 13, 2026 update, and there is no year four.

In practical terms: as of now, a server running Windows Server 2012 or 2012 R2 will never receive another security fix, at any price. It still boots. Dentrix, Eaglesoft or your imaging software still opens. Nothing on screen tells you anything is wrong. That is exactly what makes it dangerous.

Windows Server 2016 is the next domino

If you are already on something newer, do not assume you are clear. Windows Server 2016 reaches the end of its extended support on January 12, 2027 — less than three months away as this is written. After that date, it enters the same position 2012 R2 is in today: no more free security updates.

Windows Server 2019 and 2022 remain supported for years yet, and Windows Server 2025 is the current release. But 2016 is extremely common in practices that did a hardware refresh in the late 2010s and have not touched the server since. If that describes you, the countdown has already started, and it is short enough that planning needs to begin this quarter — not next spring.

Why an unsupported server is a genuine risk, not a technicality

It is tempting to treat “end of support” as paperwork. It is not. The danger is specific and it compounds every month.

Security researchers and attackers keep finding new flaws in Windows Server long after a version retires. On a supported system, those flaws get patched. On an end-of-life system, every newly discovered vulnerability stays open forever — and attackers know precisely which practices are still running the old versions, because unpatched systems are easy to find and easy to break into. An unsupported server is not holding steady; its defences are quietly developing permanent holes.

For a dental practice specifically, three consequences stack on top of that technical risk:

• It is a ransomware magnet. Unpatched servers are among the most common footholds in healthcare ransomware, and dental practices are being hit hard — healthcare ransomware surged through the third quarter of 2026, and an out-of-support server is exactly the weakness those campaigns look for.
• It undermines your compliance and privacy posture. Keeping patient records on an operating system that can no longer be secured is very difficult to defend under PHIPA and PIPEDA if a breach ever happens. “We knew it was unsupported and kept using it” is not a position any practice wants to be in.
• It can void your cyber-insurance and lose vendor support. Insurers increasingly ask whether your systems are supported and patched; an honest “no” can reduce or deny a claim. Software vendors, too, routinely stop supporting their products on retired operating systems — so the day you most need help, you may not be eligible for it.

Step one: find out what you actually have

You cannot make a decision about a server you have not identified. Before anything else, inventory every server and workstation in the practice and note which Windows version each one runs. On any given machine, pressing the Windows key, typing winver and hitting Enter shows the version in a second. The server that runs your practice-management database and the one that stores your imaging are the two that matter most — but kiosk machines, the X-ray acquisition PC and the back-office computer all count too.

This inventory is the same groundwork that makes everything else easier, from backups to patching. In fact, knowing exactly what is on your network, how it is protected and when each piece was last updated is the foundation of the kind of server backup, patch and access checklist every practice should be running regardless of this deadline.

Step two: plan the migration — before it becomes an emergency

Moving off an end-of-life server is a project, and done calmly it is a routine one. Done in a panic after a breach, it is expensive and disruptive. The difference is entirely about timing. A sensible path looks like this:

• Confirm application compatibility first. Check with Dentrix, Eaglesoft, your imaging vendor and any bridges or integrations which operating systems they currently support. The target is almost always Windows Server 2022 or 2025 — platforms with years of support ahead of them.
• Decide between a hardware refresh and a rebuild. A server old enough to run 2012 R2 is likely aging hardware as well; a clean build on new or virtualized hardware is often cheaper and more reliable than trying to upgrade in place. For some practices, a properly secured hosted or cloud option is worth weighing too.
• Protect the data and test the restore. Before any migration, verify you have complete, working backups of your practice-management database and imaging — and actually test restoring them. A migration is the worst possible time to discover a backup was incomplete.
• Harden the new platform from day one. A migration is the natural moment to get current patching, proper remote-access controls and network segmentation right, rather than carrying old shortcuts onto the new box.

If replacement genuinely cannot happen before the data can be moved, an end-of-life server should at minimum be isolated — kept off the open internet, tightly segmented away from the rest of the network, and watched closely — as a short-term stopgap, never a destination. The same discipline applies to older machines whose risk is baked into the hardware itself, which is why threats like malware that survives a reinstall on aging computers make a clean refresh the safer long-term answer.

What this means for your practice

The honest summary is simple. If you are on Windows Server 2012 or 2012 R2, you are already running unprotected and the clock ran out two weeks ago — this should move to the top of your list now. If you are on Windows Server 2016, you have until January 12, 2027, and that is close enough that planning belongs in this quarter’s budget. If you are on 2019, 2022 or 2025, you are fine for now, but the inventory is still worth doing so the next deadline never catches you by surprise. None of this is an emergency today; all of it becomes one if it is ignored until a breach forces the issue.

How Compudent Systems can help

Compudent Systems helps dental practices across the GTA and Ontario get ahead of exactly these deadlines. We will inventory every server and workstation in your office, identify anything running an end-of-life or soon-to-retire version of Windows, confirm what your practice-management and imaging software actually supports, and plan and carry out a migration onto a current, supported platform — with your data backed up, tested and your new environment hardened from the start. If you are not sure what your practice server is running, or you know it is overdue, contact Compudent Systems for a server lifecycle assessment before the next deadline decides the timing for you.

Sources & further reading:

• Microsoft — final Windows Server 2012/2012 R2 Extended Security Update (October 13, 2026)
• IT-Connect — Windows Server October 2026 updates and end-of-support milestones
• Lansweeper — Windows Server end-of-life reference

Related Reading

• October 2026 Patch Tuesday: Microsoft Fixes a Record 1,400+ Flaws and an Exploited Windows Zero-Day — What Dental Practices Must Patch Now
• Dentrix Just Stopped Supporting Windows 10: What Every Practice Still Running It Needs to Do Now
• Still Running Windows 10 at the Front Desk? Why an Unsupported OS Is Now a HIPAA Problem

The post Your Practice Server May Have Just Gone Dark: Windows Server 2012/2012 R2 Reaches End of Life, and the Server 2016 Countdown Begins appeared first on Compudent Systems.

When Soniva Dental Care, a multi-location Texas group, was hit this spring, the intrusion was traced to its remote desktop infrastructure. A group calling itself The Gentlemen claimed the attack, and by late summer had published a full dataset that reportedly included Social Security numbers, driver’s licence numbers and protected health information for roughly 30,000 people. It was not an exotic zero-day or a nation-state operation. It was a door that faced the internet.

That is the uncomfortable lesson of this year’s breaches: the most common way into a dental practice is not a brilliant exploit. It is a login box the whole world can reach. This article explains why Remote Desktop keeps being the entry point, and — more usefully — exactly what closes it.

Why remote access exists in the first place

Almost every practice has a legitimate reason to reach its systems from outside the building. The dentist wants to review a chart from home. A practice-management consultant logs in to reconcile the ledger. The imaging vendor needs to troubleshoot a bridge. The billing company works your accounts remotely. All of that is normal, and none of it is the problem.

The problem is how that access is usually set up. The fastest way to make a server reachable from outside is to publish Microsoft’s Remote Desktop Protocol (RDP) straight to the internet — open port 3389 on the router, point it at the server, and hand out the password. It works immediately. It also means anyone, anywhere, can now see your login prompt.

An exposed login box never sleeps

Here is what practices rarely picture. The moment a Remote Desktop service is exposed to the internet, automated scanners find it — usually within hours. From that point, it is under a constant, grinding stream of login attempts: lists of common passwords, credentials leaked from unrelated breaches, and the practice’s own email-style usernames guessed from the website.

None of this requires a human sitting at a keyboard. It is cheap, automated and relentless. If a single account has a weak or reused password — the kind a busy office sets up “temporarily” and never changes — the attacker eventually walks straight in with valid credentials. No alarm sounds, because from the server’s point of view, someone simply logged in.

The two settings that turn a guess into a breach

Two missing controls are what separate a loud, harmless knocking from an actual compromise.

The first is account lockout. Without a limit on failed attempts, an attacker can try tens of thousands of passwords a day against the same account, indefinitely. With a sensible lockout policy, that automated guessing stalls almost immediately.

The second, and the more important, is multi-factor authentication (MFA). If reaching the server requires a second factor — a code or an approval on the dentist’s phone — then a stolen or guessed password is no longer enough on its own. The overwhelming majority of remote-access intrusions we see would have been stopped cold by MFA alone. It is the single highest-value control a practice can add, and on most setups it is simply switched off.

The fix is a gateway, not an open door

The goal is not to kill remote access. It is to stop publishing the login box to the entire internet. The modern pattern is straightforward:

• No direct RDP to the internet. Port 3389 should not be open on your router. If it is today, that is the first thing to close.
• Reach the practice through a VPN or a dedicated remote-access gateway. Authorised users connect to a secure tunnel first, and only then can they reach internal systems. The server itself is invisible to the outside world.
• Require MFA on that gateway for every remote user, without exception — including vendors and consultants.
• Give each person their own account, with only the access their job needs. Shared logins and standing administrator rights are exactly what let a single compromised credential become a practice-wide disaster.

This is the same principle behind treating your network edge seriously in the first place. A consumer router handing out an open port is not a security device; as we covered in why a dental practice needs a business-grade firewall rather than a consumer router, the boundary between your practice and the internet deserves equipment built for the job.

Assume one machine will fall — and contain it

Even with remote access locked down, the discipline does not end at the perimeter. Phishing still tricks staff into handing over credentials, which is why the breach so often starts with a single click. Assume that, sooner or later, one device inside the practice will be compromised — and design so that it does not take everything with it.

Network segmentation is how. The server, the front-desk computers and the imaging devices should sit in separate zones, so a foothold on one does not grant a free run of all of them. The practice-management server in particular belongs behind its own wall, reachable only by the people and services that genuinely need it.

And because no prevention is perfect, the other half of containment is noticing. The Soniva case and others like it played out over weeks, not minutes. Attackers who get in tend to linger — looking around, escalating access, staging data to steal — well before they trigger the ransomware. That gap is your opportunity, but only if someone is watching. We wrote about why the time an intruder spends undetected inside your network is the metric most practices ignore; logging and monitoring on remote access turn that dwell time from the attacker’s advantage into yours.

What this means for your practice

If you take one thing from this year’s dental breaches, make it this: find out, today, whether anything in your office is reachable from the internet by Remote Desktop. If the answer is yes — or if you are not sure — that is the open door, and it is almost certainly being knocked on right now.

The reassuring part is that this is a solved problem. Closing RDP, putting remote access behind a VPN with MFA, giving people their own least-privilege accounts, segmenting the network and watching the logs are all well-understood, affordable steps. They are not the stuff of a security overhaul; they are basic hygiene for a practice that keeps protected health information on a server. The broader trend is not reassuring — healthcare ransomware has surged sharply through 2026 — but the specific thing that lets it in is squarely within your control.

How Compudent Systems can help

Compudent Systems works with dental practices across the GTA and Ontario to close exactly these gaps. We will audit how your practice is reached from outside, retire any exposed Remote Desktop, stand up secure remote access with multi-factor authentication, segment your network so the practice-management server is properly walled off, and put monitoring in place so an intrusion is caught early rather than discovered on a leak site. If you are not certain whether your remote access is an open door, contact Compudent Systems for a remote-access security assessment — it is a short conversation that can prevent a very long bad day.

Sources & further reading:

• Soniva Dental Care ransomware breach (remote desktop infrastructure; ~30,000 affected)
• Becker’s Dental — running tally of 2026 dental data breaches
• HIPAA Journal — cybersecurity incidents at multiple dental practices

Related Reading

• Attackers Rooted Fully-Patched Ivanti VPNs: What the Connect Secure Zero-Day Chain Means for Remote Access in Your Practice
• When Remote Support Turns Hostile: How Attackers Abuse Legitimate RMM Tools Against Dental Practices
• 9 Dental Data Breaches Already in 2026: What the DentaQuest and Absolute Dental Attacks Teach Every Practice

The post The Way In Was Remote Desktop: What 2026’s Dental Ransomware Breaches Keep Showing Us appeared first on Compudent Systems.

Most practices assume that server is protected. There is a backup of some kind, Windows updates install now and then, and the system has run for years without incident. But “it has always worked” is not a protection plan, and the gaps that matter are rarely visible until the worst day. Here is the checklist we use to decide whether a Dentrix server is genuinely protected — or just lucky so far.

1. Backups you have actually restored, not just scheduled

Every practice believes it has backups. The question that matters is different: when was the last time someone restored one and confirmed Dentrix actually opened from it? A backup job that runs green every night but has never been tested is a hope, not a safety net. Drives fill up silently, database files get skipped, credentials expire, and the failure is invisible until you reach for the backup in an emergency and it is incomplete or corrupt.

Dentrix’s own installation guidance is blunt on this point: you must have a backup and restore plan for the database — a plan, not just a copy. A real plan means scheduled backups of the full database and its transaction logs, periodic test restores to prove they work, and verification that the backup captured the Dentrix data and not just the empty folder around it.

2. At least one backup ransomware cannot reach

The reason backups have become the single most important control is ransomware. Modern attacks do not just encrypt the live server — they hunt for the backups first and destroy or encrypt those too, because an attacker knows a practice with good backups will never pay. With healthcare ransomware rising sharply through 2026, a backup that sits on the same network, reachable with the same login, is a backup the attacker also owns.

That is why at least one copy has to be offline, offsite, or immutable — stored where it cannot be altered or deleted even by someone with full administrative control of the server. The common “3-2-1” rule is a good baseline: three copies of the data, on two different kinds of media, with one kept off the premises. If every copy of your Dentrix database can be reached from the server itself, you do not yet have a ransomware-proof backup.

3. The encryption certificate — the backup’s hidden single point of failure

Protecting patient data at rest increasingly means encrypting the database, and Dentrix’s guidance calls for exactly that, using transparent data encryption (TDE) to protect the SQL data at rest. It is the right thing to do. But it introduces a trap that has caught more than one practice: a restore of an encrypted database requires the encryption certificate, and if that certificate is lost, the backup is permanently unreadable. The guide spells it out — you must maintain backups of the server certificates to prevent data loss.

In plain terms: you can do everything else right — nightly backups, offsite copies, the works — and still lose everything if the key to decrypt them was only ever stored on the server that died. The certificate has to be backed up separately and kept somewhere safe, or the encryption you added for safety becomes the thing that locks you out.

4. Least privilege — stop handing out the master key

Many practices still run day-to-day Windows accounts with local administrator rights, and in too many the Dentrix server is reachable with the same shared password everyone knows. That is the single biggest accelerant for a breach. Malware runs with the rights of whoever is logged in; if that account is an administrator, a single bad click can reach straight into the server and the backups.

The fix is least privilege: ordinary staff accounts do routine work and nothing more, administrator access is a separate, rarely-used credential, and no one logs into the server for daily tasks. This is the same weakness attackers exploited through flaws in practice management software itself — the less standing access an account has, the less an attacker gains when they compromise it.

5. Patch the server — and watch for version drift

A Dentrix server is really a stack: Windows Server underneath, a SQL database engine on top, and Dentrix itself. All three need to stay current. Skipped Windows and SQL Server updates leave known holes open, and a single bad update can also take a server down — as practices learned when a Windows update sent Server 2019 domain controllers into a boot loop. Patching has to be deliberate and monitored, not automatic-and-forgotten.

The quieter danger is version drift. Operating systems and database engines reach end of support and stop receiving security fixes, yet the server keeps running because it still “works.” An unsupported Windows Server or SQL version under Dentrix is a liability that grows every month. Knowing the end-of-support dates for your stack — and planning the upgrade before, not after — is part of protecting the server.

6. Physical and network boundaries

Finally, the boundaries around the server. Physically, it should live behind a locked door, not under the front desk where anyone passing through can reach it, restart it, or walk off with a drive. On the network, clinical systems belong behind a proper business-grade firewall with the server segmented away from guest Wi-Fi and general internet traffic. Remote access for support should be controlled and logged, never an always-open door. These boundaries decide how far an intruder can get before they ever reach the machine your practice depends on.

What this means for your practice

None of these six items is exotic, and you do not need to be a database administrator to insist on them. Ask the plain questions: When did we last restore a backup and confirm Dentrix opened? Is one copy somewhere ransomware cannot touch it? Do we have the encryption certificate backed up separately? Who has administrator rights, and do they need them? Is the server’s software still supported? Is it physically and network-secured? If any answer is “I’m not sure,” that is the gap to close before it closes the practice.

How Compudent Systems can help

At Compudent Systems, we protect the servers dental practices across the GTA and Ontario run their day on — monitored backups with regular test restores, offsite and immutable copies that survive a ransomware hit, properly managed encryption and certificate safekeeping, least-privilege accounts, disciplined Windows and SQL patching, and the physical and network boundaries that keep the server out of reach. If you cannot say with confidence that your Dentrix server would come back from its last backup, contact Compudent Systems for a server and backup assessment — and let us make sure the one machine your practice cannot run without is genuinely protected.

Sources & further reading:

• Dentrix Enterprise 11.0.20 Installation Guide — backup and encryption guidance (IHS)
• Dentrix Enterprise 11.0.20 System Requirements (IHS)

Related Reading

• Your Backups Are Only as Good as Your Last Test Restore: A Dental Practice Reality Check
• MFA, Encryption, 72-Hour Restore: Washington’s HIPAA Overhaul Is a Preview of the New Security Floor for Every Dental Practice
• When the System Goes Down: Building a Downtime and Business-Continuity Plan for Your Dental Practice

The post Is Your Dentrix Server Actually Protected? The Backup, Patch, and Access Checklist Most Practices Skip appeared first on Compudent Systems.