A dental practice can lose access to far more than a few office files when ransomware strikes. Appointment schedules, patient notes, digital X-rays, treatment plans, Medicare claiming, email and EFTPOS can all be affected at once. This dental ransomware recovery example shows what a measured recovery can look like, and why preparation makes a material difference to patient care and business continuity.
The scenario below is representative rather than a description of one client. The details reflect the decisions a small to medium dental practice in the Central Coast, Newcastle or Hunter region may need to make when systems suddenly become unavailable.
A dental ransomware recovery example in practice
At 7:15 am on a Tuesday, a practice manager arrives to find a ransom message on the reception computer. The practice management system will not open, shared folders are inaccessible and several workstations display the same message demanding payment in cryptocurrency.
The practice has three dentists, two hygienists and a busy reception team. It relies on a server for practice management software and imaging, while Microsoft 365 is used for email and documents. The immediate concern is not technical. The team has patients due through the door within 45 minutes, including emergency appointments.
The first decision is to contain the incident. Staff are asked not to restart computers, log in repeatedly or connect personal devices. The affected network is isolated from the internet and other sites. This helps stop ransomware spreading further or allowing an attacker to continue working inside the environment.
The practice does not pay the ransom. That is not a decision to make lightly, particularly where patient records and a full day of bookings are involved. However, payment offers no guarantee that files will be returned, that stolen data will be deleted or that the attacker has been removed. In this case, the practice has a recovery plan and protected backups, so restoring from known-good copies is the safer path.
Keeping the practice open, where possible
The practice manager uses a printed emergency contact list and a paper appointment process. Reception contacts the first patients of the day to explain that check-in may take longer and that some appointments may need to be rescheduled. Clinicians can still manage urgent cases, but have limited access to patient history until systems are restored.
This is an uncomfortable compromise. Cancelling every appointment may reduce clinical risk, while remaining open for urgent care may be appropriate if the practice can do so safely and meet its obligations. The right approach depends on which systems are affected, what records remain available and the advice received during the incident.
Meanwhile, the IT team checks whether cloud email, mobile phones and internet services have been affected. Separating systems during containment can interrupt normal communications, so having an alternate contact method matters. A mobile phone hotspot, a temporary call diversion or access to cloud email from a clean device can keep the practice connected while recovery is underway.
What the recovery process looked like
A proper recovery is not simply restoring the last backup and hoping for the best. The team first needs to understand the scope of the incident. Which devices were encrypted? Was the server affected? Is there evidence that patient information was copied before the ransomware was launched? Could the attacker still have access through a compromised password or remote access tool?
The affected server is kept offline for investigation. Rather than restoring directly onto potentially compromised equipment, the IT provider rebuilds a clean server environment and applies current security updates. User passwords are reset, particularly administrator accounts, and multi-factor authentication is checked across email and remote access services.
The backup system is then reviewed. The most recent backup is available, but it is not restored immediately. The team verifies that it predates the encryption event and checks that the backup itself has not been altered. This is one reason separate, protected backup copies are so valuable. If backups are always connected to the same network, ransomware may encrypt them too.
Once the backup is confirmed as clean, the practice management database and imaging data are restored to the rebuilt environment. This takes time. Large image libraries can take longer to restore than standard documents, especially where internet-based backup is involved. A practice should understand this before an incident, not while patients are waiting at reception.
By late afternoon, the essential practice management system is available for staff testing. A clinician and the practice manager confirm that patient records, bookings, notes and treatment information appear as expected. The next morning, the practice resumes normal bookings with a small backlog to work through.
The total disruption is still significant: a disrupted day, delayed administration, extra staff pressure and follow-up work. But the practice avoids a prolonged closure and has a clear record of what happened, what was restored and what needs to change.
Patient information changes the response
Dental records are sensitive health information. A ransomware event may therefore be both an operational outage and a possible privacy incident.
Encryption alone does not always prove that information was taken. Many ransomware groups now attempt to copy data before locking systems, then threaten to publish it if payment is not made. The recovery team should preserve relevant evidence, review security logs where available and assess whether there are reasonable grounds to believe personal information was accessed or disclosed.
Where a serious data breach is suspected, the practice may need legal and privacy advice, including consideration of obligations under the Notifiable Data Breaches scheme. Patient communication should be accurate and timely, but it should not be rushed before the practice understands the facts. Saying too little can undermine trust; saying too much before evidence is available can create confusion.
This is also why cyber insurance, if held, should be notified early. Insurers often require the use of particular incident response providers or legal advisers. Waiting until recovery is complete can complicate a claim.
Why this practice recovered faster
The recovery worked because several practical controls were already in place. None was especially glamorous, but together they reduced the consequences of the incident.
First, the practice had backups that were monitored and separated from day-to-day systems. A backup is only useful if it can be restored, so regular test restores are as important as the backup schedule itself. Practices should confirm how long it would take to recover their database, images and key files, not just whether a green tick appears in a backup dashboard.
Second, the practice knew which systems mattered most. The order was clear: patient management, clinical records and imaging first; then email, printing, shared documents and less critical administration. That priority list prevented time being wasted restoring lower-value systems while the front desk remained unable to book patients.
Third, staff knew who to call. The practice manager did not need to search for an IT provider while dealing with upset patients and a ransom note. A current incident contact list and agreed escalation process can save valuable hours.
Finally, the practice had basic security controls in place, including multi-factor authentication, managed endpoint protection and restricted administrator access. These controls do not make an organisation immune to ransomware. They do reduce common entry points and make recovery easier to manage.
What dental practices should check now
The most useful question is not whether your practice has a backup. It is whether you could safely continue operating if your main system was unavailable tomorrow morning.
Start by identifying the systems that hold patient records, appointments, X-rays, correspondence and financial data. Confirm where each system is hosted, who supports it and whether its data is included in backup arrangements. Some software vendors provide their own cloud backup, while others leave this responsibility with the practice. Do not assume the answer.
Then ask for evidence of a recent restore test. A successful test should show that the information can be recovered, is usable and can be restored within a timeframe the practice can tolerate. Recovery time will vary based on data volume, internet speed and the type of system, so there is no universal target.
Review access as well. Former employees, shared passwords and accounts with more access than necessary create avoidable exposure. Multi-factor authentication should be used for email, remote access and administrator accounts at a minimum.
It is also worth documenting a short paper-based downtime procedure for reception and clinical staff. It should cover patient arrivals, urgent appointments, staff contacts, communication methods and when to stop using affected devices. A one-page process that people can follow under pressure is more useful than a lengthy document nobody has read.
For practices without internal IT resources, a managed provider can help test backups, maintain security controls and turn these decisions into an achievable recovery plan. Simple IT works with businesses across the Central Coast, Newcastle and the Hunter to put those practical safeguards in place before an incident forces the issue.
A ransomware recovery plan will not make a difficult day easy. It can, however, give your team a calm, documented path back to patient care when normal systems are unavailable.
