Creative Smiles Pediatric Dentistry listed by CRPxO ransomware group

• Ransomware group: CRPxO
• Country: United States
• Sector: Healthcare
• Announcement date: July 9, 2026

CRPxO claims to have stolen data from Creative Smiles Pediatric Dentistry

The threat actor group known as CRPxO has published a leak announcement on its platform, claiming to possess a significant amount of data belonging to Creative Smiles Pediatric Dentistry. According to the announcement made on July 9, 2026, the group asserts that they have exfiltrated 2.5 GB of information from the organization. This type of activity is characteristic of modern ransomware operations, where attackers often employ double extortion tactics. In such scenarios, threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage, threatening to publish the information on a public leak site if their demands are not met.

The group's announcement alleges that the breach occurred on July 9, 2026. According to the claims made by CRPxO, the attackers managed to compromise data directly from the institution's workstations. The group has cited alleged security negligence as the primary justification for their actions and has threatened to release the stolen information publicly.

Details of the alleged data exfiltration

The information claimed to be stolen by CRPxO is extensive and covers various aspects of the clinic's operations, including clinical, financial, and administrative records. The group asserts that the exfiltrated data includes a wide range of sensitive materials. The specific items identified in the claim include:

• Patient X-rays
• Clinical images
• Treatment narratives
• Patient names
• Dates of service
• Medical histories
• Referral letters
• Accounts receivable reports
• Bank deposit slips
• Insurance claims
• Explanation of benefits
• Plain-text business and insurance portal logins
• Password files
• Provider NPI numbers

The exposure of such a diverse dataset suggests that the attackers gained access to various layers of the organization's digital environment, ranging from clinical imaging systems to financial and administrative databases.

About Creative Smiles Pediatric Dentistry

Creative Smiles Pediatric Dentistry is a pediatric dental clinic located in Prosper, Texas. The institution provides specialized dental care and treatment services specifically designed for children and adolescents.

Potential impact and security implications

The alleged leak poses significant risks to the affected individuals. Due to the exposure of Protected Health Information (PHI), patients may face heightened risks of identity theft and fraud. Furthermore, because the institution operates within the United States, the breach may lead to regulatory scrutiny under HIPAA compliance standards, which govern the protection and privacy of patient health information.

The mention of plain-text passwords and the alleged use of unlicensed software within the claim may indicate underlying vulnerabilities in the organization's security posture. Such vulnerabilities can be exploited by attackers to gain initial access or escalate privileges within a network. Additionally, the exposure of sensitive credentials and identity information can facilitate secondary risks, such as highly targeted phishing campaigns aimed at patients or staff members.

In the healthcare sector, organizations often face these types of threats due to the high value of medical records on the dark web. To defend against such attacks, it is common practice for healthcare providers to implement robust security measures. These typically include multi-factor authentication (MFA) to protect against the use of stolen credentials, regular security awareness training to prevent phishing, and strict patch management to address software vulnerabilities. Furthermore, maintaining rigorous compliance with healthcare regulations and ensuring all software is properly licensed and updated are essential steps in reducing the attack surface. Information regarding the specific capabilities and background of the CRPxO group remains limited at this time.