A cybersecurity attack has struck dental service organization (DSO) Chord Specialty Dental Partners, formerly Spark Dental, possibly exposing the personal data, including payment information, of more than 173,000 patients, according to a notification from the DSO.
CDHA Management and Spark DSO, doing business as Chord Specialty Dental Partners, discovered suspicious activity related to an employee's email account, according to a notification dated March 14 from the DSO.
The account was secured immediately, and an investigation by a third party revealed that an unauthorized individual had gained access to several email accounts for a limited time between August 19, 2024, to September 25, 2024, according to the notification.
A comprehensive review revealed that the following information may have been affected by the breach:
- Patient names, dates of birth, and addresses
- U.S. Social Security numbers
- Driver's license numbers
- Bank account information
- Payment card information
- Medical histories
- Health insurance information
On March 14, Chord notified the U.S. Department of Health and Human Services Office for Civil Rights, a step that is legally required when there may be a breach of unsecured protected health information. The hack may have affected 173,430 individuals, according to the filing with the department.
Currently, Chord is unaware that any person's personal data has been fraudulently misused.
"However, we were unable to rule out the possibility that the information could have been accessed," according to Chord's notification. "Therefore, in an abundance of caution, we are notifying potentially impacted individuals of this incident."
In response to the incident, Chord has reviewed its policies and procedures related to data security, and it is providing potentially affected individuals access to credit monitoring and identity protection services.
In April 2024, Spark Dental rebranded to Chord Specialty Dental Partners. It is affiliated with more than 60 practices in six states.
