Artistic Family Dental, Value Dental Center, and Sparkling Smiles Family Dentistry targeted by Everest

• Ransomware group: Everest
• Country: United States
• Sector: Healthcare
• Announcement date: December 17, 2024

Everest ransomware group claims data breach against dental providers

The Everest ransomware group has published a notice on its leak site claiming responsibility for a data breach involving multiple healthcare entities. According to the announcement made on December 17, 2024, the group claims to have targeted Artistic Family Dental, Value Dental Center, and Sparkling Smiles Family Dentistry. This claim suggests that the threat actor may have gained unauthorized access to the networks of these specific organizations.

Ransomware groups often utilize leak sites to increase pressure on their victims through a tactic known as double extortion. In such scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also exfiltrate sensitive data. The threat of releasing this stolen information on a public or semi-public platform is used as leverage to coerce the victim into paying a ransom. By listing organizations on these sites, threat actors aim to damage the reputation of the victim and create public pressure to ensure payment.

Details of the alleged attack and data exposure

The announcement by the Everest group indicates that the breach was identified on December 17, 2024. The group claims to have made data, allegedly belonging to Artistic Family Dental, Value Dental Center, and Sparkling Smiles Family Dentistry, available for download via an external file-sharing platform, specifically using gofile.io. This method allows the attackers to distribute stolen information to a wider audience, including security researchers and other malicious actors.

Regarding the specific content of the breach, the announcement does not provide details on the nature of the data involved. The listing names no specific data types or categories of information that were allegedly stolen during the incident. Furthermore, the group has not disclosed the total size of the data or the specific number of files that were exfiltrated. There is also no information available regarding a ransom demand or the specific circumstances under which the access was gained.

The Everest ransomware group profile

The Everest group is a known threat actor that has been active since 2020. The group is recognized for engaging in various cybercriminal activities, including data theft, extortion, and the sale of unauthorized access to different organizations. Their operational model typically involves targeting high-value sectors to maximize the impact of their extortion attempts.

Implications for the healthcare sector and potential risks

The potential exposure of data from these healthcare entities poses significant risks to patient privacy and the protection of personal information. Because the affected organizations are based in the United States, this incident may carry legal implications under the Health Insurance Portability and Accountability Act (HIPAA) regulations, which govern the protection and privacy of sensitive patient health information.

The disclosure of such data can lead to several secondary risks for the individuals involved. These include the possibility of identity theft and the execution of targeted phishing attacks, where attackers use stolen information to gain further trust and access to victims. For the organizations themselves, such incidents can result in significant operational disruptions and long-term reputational damage.

To mitigate these risks, organizations in the healthcare sector typically focus on strengthening their defensive posture. Common defensive steps include implementing robust multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for staff. Additionally, maintaining offline, immutable backups and implementing strict network segmentation can help limit the lateral movement of attackers and ensure that services can be restored quickly in the event of an incident.