mcna.net Listed by lockbit3 Ransomware Group
If you are a customer of mcna.net, here’s what is being claimed, and what it would mean for you.
MCNA Dental (MCNA Insurance Company and Managed Care of North America, Inc.) is a leading dental benefits manager committed to providing high quality services to state agencies and managed care organizations for their Medicaid, Children's Health Insu...
— from LockBit’s own leak-site posting. This is the group’s claim, quoted verbatim; it is not GalaxyWarden’s reporting and has not been independently verified.
On March 27, 2023, dental benefits administrator MCNA Dental appeared on the LockBit 3.0 ransomware leak site, claiming that internal files had been exfiltrated during a ransomware attack. The listing affects anyone whose dental insurance, Medicaid dental benefits, or managed-care records are handled by MCNA, which serves state agencies and health plans across multiple states. The leak-site posting does not specify the number of individuals impacted or list exact data types beyond “internal files.”
Watch mcna.net
Get alerted the next time mcna.net files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about mcna.net’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details in the Leak-Site Listing
The primary disclosure on the LockBit 3.0 onion site states that MCNA Insurance Company and Managed Care of North America, Inc. suffered a ransomware intrusion and that attackers successfully exfiltrated internal files. No victim count, ransom amount, or detailed inventory of stolen data appears in the posting. The entry simply states that data was taken and warns that it will be published if demands are not met. Public reporting on LockBit 3.0 indicates the group typically posts samples or full datasets after an initial extortion window expires.
- Every indexed leak tied to your address — all of them, named and dated
- A deeper search of collected breach data — the kinds of your information it holds, where it finds you
- What this kind of incident typically exposes
- A ten-minute lock list written for this kind of organisation
Why This Matters for You and Your Family
If you or your children receive dental benefits through Medicaid, a state health plan, or an employer-sponsored program administered by MCNA, your personal information may sit inside the stolen files. Dental records frequently contain names, addresses, dates of birth, Social Security numbers, policy IDs, and treatment histories. When this information reaches criminal marketplaces, it fuels identity theft, fraudulent claims, and targeted phishing campaigns aimed at your household. Families relying on government-assisted dental coverage are often hit hardest because they have fewer resources to monitor or remediate misuse of their data.
Doxxing and Identity-Chain Risks
Stolen insurance files rarely stay isolated. Attackers cross-reference names, addresses, and policy numbers with other breaches to build complete identity profiles. A single leaked email or phone number from the MCNA files can link your gaming accounts, social-media handles, and family members’ profiles into one continuous chain. Children’s dental records are especially dangerous because they tie a minor’s identity to a parent’s address and contact details, creating long-term doxxing exposure that can follow them into adulthood. Credential leaks of this nature routinely cascade into account takeovers on Steam, Roblox, Discord, and other platforms where kids reuse passwords.
LockBit 3.0 Track Record
Public reporting attributes the LockBit 3.0 variant to a ransomware-as-a-service operation that first appeared in 2020 and rebranded to version 3.0 in early 2022. The group has targeted hospitals, manufacturers, financial firms, and government contractors. Their standard playbook involves initial access through compromised remote-desktop credentials or phishing, followed by rapid exfiltration of sensitive files before encryption. They then run a double-extortion campaign: demanding payment to prevent data publication and offering a second fee to decrypt locked systems. The MCNA listing fits this pattern exactly.
What to do
- Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
- Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
- Rotate any password you used on MCNA-related portals or state health sites and switch to 2FA through an authenticator app everywhere that password was reused.
- Cover the household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that chain back to the same address or parent email.
- Let remediation specialists handle ongoing takedown requests across data brokers and extortion sites on your behalf.
The incident underscores that even routine dental-benefit data can anchor sophisticated identity chains. One timely scan and continuous watch can break those chains before criminals exploit them. DoxxScan by GalaxyWarden delivers exactly that combination: continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.
What the free scan actually returns
Found on people-search siteswe remove these
These listings are live, public, and legal to remove — and removing them is what we do.
Found in breach recordsverifiedreported — unverified
Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.
Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.
