It started on a Tuesday at 6:47 AM. The office manager at a three-operatory general practice in suburban Tampa arrived early, coffee in hand, ready to prep the schedule. The monitors showed a single message: a ransom demand, a Bitcoin wallet address, and a countdown timer.

By 6:52 AM, the practice management system was locked. Patient records — names, dates of birth, Social Security numbers, treatment histories — all encrypted behind a wall that would cost $80,000 to unlock. The morning's twelve patients would need to be called and rescheduled. The afternoon's emergency extraction? That patient's medical history was gone.

This isn't a hypothetical scenario. In 2025, incidents like the Tieu Dental Corporation breach in California confirmed a pattern that cybersecurity analysts had been warning about for years. An unauthorized third party accessed the practice network, moved laterally through unpatched systems, and exfiltrated protected health information before encrypting the drives. The forensic investigation took weeks. The regulatory fallout took months. The reputational damage is still ongoing.

For dental practices operating in 2026, the question isn't whether a ransomware attack could happen to you. It's whether you'll survive the first 72 hours when it does.

Hour Zero to Hour Four: Containment

The instinct is to call your IT person. That's correct — but what you do before they arrive matters more than most owners realize. The first rule: do not turn off the affected machines. Powering down can destroy forensic evidence that your HIPAA breach investigation will require later. Disconnect them from the network instead. Pull Ethernet cables. Disable Wi-Fi on every workstation you can reach.

If your practice uses cloud-based practice management software, change every password associated with that platform from a clean device — your personal phone, a laptop that wasn't connected to the office network. If you're running server-based software on-premises, assume the server is compromised until proven otherwise.

Document everything with timestamps. Photograph the ransom screen. Note which machines were affected. This log becomes Exhibit A in your HIPAA incident report.

Hour Four to Hour Twenty-Four: Triage

Your IT provider or managed services company should be conducting a forensic assessment. The critical questions: How did the attacker get in? How long were they inside the network before deploying the ransomware? What data was accessed or exfiltrated?

The dwell time question is the one that keeps practice owners up at night. In many healthcare breaches, attackers are inside the network for days or weeks before triggering the encryption. During that window, they're copying data — patient records, insurance information, financial documents — to external servers. Even if you restore from backup and never pay the ransom, the data may already be for sale on dark web marketplaces.

This is also the window where you contact your cyber liability insurance carrier. If you have a policy (and in 2026, operating without one borders on negligence), your carrier will assign a breach coach — typically an attorney who will manage the notification process and coordinate legal response.

Hour Twenty-Four to Hour Seventy-Two: Notification and Recovery

HIPAA's Breach Notification Rule requires covered entities to notify affected individuals within 60 days of discovering a breach affecting 500 or more people. But the 2026 regulatory environment has shifted significantly. State attorneys general are now enforcing faster timelines, and the proposed HIPAA Security Rule updates make it clear that regulators will scrutinize your pre-breach posture just as aggressively as your response.

The financial math is brutal. Multi-day downtime alone costs dental practices between $5,000 and $20,000 per day in lost production. Add forensic investigation fees ($15,000–$50,000 for a small practice), notification costs, potential HIPAA fines, and the long tail of credit monitoring services you'll need to offer affected patients — and you're staring at a six-figure event from what started as a single phishing email clicked by a part-time hygienist.

The Playbook You Should Have Built Yesterday

Practices that survive ransomware share common traits: they had immutable offsite backups that weren't connected to the infected network. They had an incident response plan written down and rehearsed — not just a vague understanding that "IT will handle it." They had endpoint detection running on every workstation, not just the server. And they had segmented their network so that a compromised front desk machine couldn't reach the imaging server.

The 72-hour window after a ransomware attack is a stress test for every decision you made in the months before it happened. The practices that pass that test aren't lucky. They're prepared.

The ones that fail? They're the ones calling their malpractice attorney on Wednesday morning, wondering how a single clicked link turned into the most expensive week of their career.