MCNA Dental 1 million patients records Listed by Everest Ransomware Group

On September 16, 2024, the Everest ransomware group listed MCNA Dental on its leak site, giving the company 24 hours to contact the attackers or face publication of more than 1 million patients’ personal EMR records and internal company documents.

Primary Disclosure Details

The Everest leak-site entry states that MCNA Dental suffered a ransomware attack in which internal files were exfiltrated. It explicitly warns that unless the company makes contact within the final 24-hour window using instructions left on the victim’s systems, “all data will be published.” The listing includes a sample record containing names, full street addresses, dates of birth, phone numbers, policy identifiers, eligibility dates, and dollar amounts tied to Texas CHIP coverage. The disclosure does not quantify the exact number of records beyond the claim of more than one million, nor does it name the initial access vector or the precise date of compromise. Public reporting on Everest indicates the group typically posts proof-of-exfiltration samples before moving to full data release if demands are unmet.

Why This Matters for You and Your Family

If you or any member of your household has ever been covered by MCNA Dental, especially under Texas CHIP or similar public programs, your personal information is now at immediate risk. Full names, home addresses, dates of birth, and phone numbers are the exact ingredients identity thieves need to open accounts, file fraudulent tax returns, or impersonate you with insurers and government agencies. Children’s records are particularly exposed in pediatric dental plans; a single leaked child record can anchor years of synthetic identity fraud that surfaces only when the child reaches adulthood. Because the data was taken from a claims and eligibility system, it also contains policy numbers and service dates that could be used to commit medical identity theft or fraudulently bill insurers in your name.

Doxxing and Identity-Chain Risks

Medical and dental records rarely exist in isolation. A street address and date of birth pulled from an MCNA file can be cross-referenced with school records, gaming accounts, or social-media profiles to build a complete household map. Once attackers link a parent’s email to a child’s Roblox or Fortnite username, they can pivot into social engineering that targets the entire family. Credential leaks of this type frequently cascade into account takeovers across unrelated services that reuse the same password or security questions derived from the exposed personal details. The speed with which Everest moves from listing to public dump means the window for proactive defense is measured in hours rather than weeks.

Everest Ransomware Group Track Record

Public reporting attributes the Everest ransomware group’s emergence to late 2020. The collective has targeted healthcare payers, municipalities, and mid-sized insurers in the years since, typically following a double-extortion playbook: encrypt victim systems, exfiltrate sensitive files, then pressure executives with both data-leak threats and ransom demands. Notable prior victims include other dental and medical administrators where patient EMRs were used as leverage. Everest’s standard operating procedure involves leaving ransom notes with dedicated contact instructions, posting initial proof packets on their Tor site, and escalating to full publication on multiple leak mirrors when silence persists. The group’s focus on healthcare data aligns with the high street value of medical identity information on underground markets.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to break those chains before the data appears on additional forums.
• Rotate any password you have ever used with MCNA Dental or any related insurer, and immediately enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your household is caught and acted upon within hours.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often become the next link in doxxing chains when dental or medical records surface.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing accounts and alerting your family.

The breach of MCNA Dental illustrates how quickly a single healthcare provider’s compromise can place an entire family’s identity at risk. Acting before the full dataset appears on additional platforms remains the most effective defense. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that explicitly includes children’s gaming accounts vulnerable to credential-stuffing attacks that follow leaks like this one.