Dental marketing firm Gargle likely source of 8M leaked patient records

Security firm calls for breach to be reported

In reviewing the trove, Cybernews was explicit in saying the accumulated data is enough to build a profile on an individual that nefarious actors could use to commit identity theft, along with a “wide spectrum of abuse” related to impersonating an individual and opening up financial accounts on their behalf. 

“The leaked dataset contains deeply sensitive information belonging to US-based patients: verified mobile numbers, home addresses, billing classifications, and institutional IDs. In isolation, any one of these data points might not seem as harmful. But bundled together, they form a comprehensive blueprint of a person’s identity,” the firm said.

“With medical data on the table, the stakes get much darker. Threat actors can use this information to commit insurance fraud or medical identity theft. Victims are also vulnerable to well-crafted phishing and social engineering attacks,” it added. 

Cybernews stopped short of affirming that this data breach is a violation of Health Insurance Portability and Accountability Act (HIPAA), and thus needs to be reported, but they did recommend the responsible party take accountability and report the incident to regulators. 

They also recommend that patients who recently received dental care monitor their credit reports for any sign of suspicious activity. 

“If you recently had a dental appointment and suspect your data might have been affected by the leak, stay vigilant of phishing attacks. Be especially cautious of any unsolicited emails that reference a healthcare provider or medical history,” Cybernews recommended, adding that this includes keeping a close eye on medical and insurance records for any unauthorized claims. 

The full report is available here. 

Gargle denies data leak occurred

HealthExec reached out to Gargle for more information and received a lengthy statement denying claims made in the report. Part of the statement from Jeff Richins, president of the marketing group is below:

On June 4, Cybernews published an article alleging that a Gargle MongoDB server exposed over 8 million dental patient records — a claim that is entirely false, misleading, and unsubstantiated.

The server in question was a small internal research and development environment, never containing more than 60,000 patient records used for testing, and was used for a limited 90-day evaluation period. It was never publicly accessible, never externally accessed, and never exposed to the internet. 

Simply put: there was no data leak, and there was no risk to any patient or client data.