Santa Barbara Endodontics, a California endodontic practice, is notifying patients that a ransomware attack encrypted its patient record files and that the attacker may have copied those records before it was found. The practice says it restored its records from backups. It is still sending breach letters, because getting the files back does not tell you whether they were taken first. For dental and medical practices, that is the lesson worth a staff meeting this week.
What the practice has said
In a notice posted on its website dated November 6, 2026, the practice says it "believes an unknown threat actor gained unauthorized access to its computer systems" and "believes the actor accessed its patient records and may have moved copies of the records from its systems." It says it does "not know the exact date or dates of intrusion." The incident came to light when the practice "received a ransom note on October 8, 2026," and on further review "patient record files on its systems were encrypted with malicious ransomware." In its words: "Fortunately, it was able to restore its patient records from backup files. Nonetheless, it launched a forensic investigation to determine the nature and scope of the event. That investigation is still underway."
The notice lists the kinds of data the attacker "may have accessed": Social Security numbers (if provided), medical and dental history, mental or physical condition, endodontic treatment or diagnosis information, insurance carrier, policy or subscriber ID numbers, insurer identifiers, and claims information. The practice says it restored operations in a new environment, notified the FBI, hired a cybersecurity firm, and notified the California Attorney General and HHS. It says the attackers have announced on the internet that they took patient information and intend to post it, and that its security partner is monitoring the dark web and the practice's systems. Affected patients are offered 12 months of identity theft monitoring.
The California Attorney General's breach list shows Santa Barbara Endodontics reported on November 6, 2026, with a breach date of October 7, 2026. HIPAA Journal reported the group making the threats as The Gentlemen; the practice's notice does not name a group.
What we are not claiming: The practice has not said how the attacker got in, how many patients are affected, or whether patient data has actually been posted, and its investigation is still underway. We are not saying a ransom was or wasn't paid; the practice's notice doesn't address payment. We are not saying data was confirmed stolen; the practice says the attacker "may have moved copies." This is a California practice, not a Brotherly client, and we use it only as an example of a pattern any practice could face.
Why "we restored from backup" is not the end of it
Good backups are the reason this practice could keep seeing patients. That part worked. But most ransomware groups now copy data before they encrypt it, then threaten to publish it. A restore fixes the encryption; it does nothing about a copy that already left the building. Under HIPAA, an encrypted or copied set of patient files is generally presumed to be a reportable breach unless a documented risk assessment shows a low probability that the information was compromised, and that assessment depends on logs and evidence you either have or don't. Practices that can't tell what left their network usually end up notifying everyone.
What to check at your practice this week
- Test a real restore, not just the backup job. Pick one day's patient records or imaging files and restore them to a separate machine. Time it. A green checkmark in the backup software is not proof you can get back to work.
- Make sure at least one copy is offline or immutable. Ask your IT provider whether ransomware running with an admin account could delete or encrypt your backups too. If the answer is "maybe," fix that first.
- Turn on the logs you will need later. Firewall, remote-access, server sign-in and file-access logs are what let an investigator say what was or wasn't taken. Confirm they are on, stored off the server, and kept for at least 90 days.
- Watch for large outbound transfers. Ask whether anything would alert you if gigabytes of data left the office overnight. That is often the only early sign of data theft.
- Close the usual front doors. Put multi-factor authentication on email, remote access and any cloud practice-management or imaging portal, and remove remote-access tools nobody uses anymore.
- Write down who calls whom. Know in advance who contacts your cyber insurer, your incident-response firm, the FBI and your patients, and keep that list somewhere you can reach if the server is down.
- Review your HIPAA risk analysis. If it doesn't mention ransomware with data theft, backup restore testing and log retention, it is due for an update.
The takeaway for IT decision-makers
Backups decide how fast you reopen. Logs, monitoring and access controls decide whether you have to send letters to every patient. A practice that can prove what did and didn't leave its network has far better options after an attack than one that can only say its files came back. If you aren't sure which one you are, ask your IT provider for a test restore and a list of the logs you keep, this month.
Sources
- Santa Barbara Endodontics: Santa Barbara Endodontics Provides Notice Following Data Security Incident (dated Nov 6, 2026; checked Nov 12, 2026)
- California Attorney General: Data Security Breach list (Santa Barbara Endodontics, breach date 10/07/2026, reported 11/06/2026; checked Nov 12, 2026)
- Becker's Dental Review: California endodontics practice suffers data breach
- HIPAA Journal: Cybercriminals Hit California Dental Practices