ProSmile Family Dental Care Listed by Crpx0 Ransomware Group

Your ProSmile Family Dental Care account details have appeared in a listing published by the ransomware group Crpx0. The company has not publicly confirmed any breach or data theft as of this writing. This means the only information currently available comes from the attacker’s own claims on their leak site.

That single fact shapes everything that follows. You are not being told your patient file is circulating on the dark web. You are being told that one ransomware crew has chosen to list ProSmile as part of its extortion campaign. The difference matters, because it changes both how seriously you should treat the listing today and what practical steps remain under your control.

What the listing actually claims — and what it does not prove

Crpx0 states that it obtained files from ProSmile Family Dental Care and is prepared to publish them unless a ransom is paid. The group’s post includes the usual screenshots and a generic description typical of these announcements. No independent party — not ProSmile, not a cybersecurity firm, not a regulator — has verified that any data was taken, that the screenshots are current, or that the files even belong to this specific practice.

Leak-site listings like this are produced under pressure. Ransomware operators often publish the name of a target early in negotiations to create urgency. In many documented cases the same listing later turns out to contain data recycled from an earlier unrelated breach, data taken from a business partner rather than the named victim, or in some instances no stolen data at all. Until the company itself issues a statement, posts a notification on its website, or regulators require disclosure, the listing remains an unconfirmed accusation rather than established fact.

This is why the strongest lens on the incident is the industry pattern itself: ransomware groups routinely list small and mid-size healthcare providers, especially dental practices, because patient records create immediate emotional pressure on the business owner. The appearance on a leak site therefore tells you more about the attackers’ standard playbook than it does about what, if anything, actually happened inside ProSmile’s systems.

What exposure would mean if patient records were taken

If files were taken, dental practices typically hold names, addresses, dates of birth, phone numbers, email addresses, treatment notes, insurance details, and sometimes Social Security numbers for billing. None of these fields are permanently secret in the way a government-issued ID is, but several remain sensitive for years.

A date of birth paired with a name and address can be used to strengthen identity-theft attempts or to answer security questions on other accounts you own. Treatment history, while private, is not usually the first thing thieves monetize; it is more often used as additional leverage against the clinic or sold in bulk to data brokers.

Importantly, the listing does not disclose how any passwords were stored. The storage scheme itself remains unknown. This means you cannot assume the passwords were safely hashed with a slow, salted algorithm such as bcrypt, nor can you assume they were stored in plain text. The only rational response is to treat your ProSmile password as potentially compromised and replace it immediately on that site and anywhere else you have reused it.

The wider pattern of healthcare extortion listings

Ransomware crews have made healthcare providers a consistent target category for the last several years. Small dental and orthodontic practices are listed with notable frequency because they often operate with limited internal security staff and because patients react strongly when their dental records are threatened with release. The appearance of ProSmile fits this established pattern exactly.

What this pattern gives you for the future is a simple rule: when you receive dental, orthodontic, or general medical care, assume that your basic contact and demographic information could eventually surface in an incident. That assumption lets you make calmer decisions now instead of reactive ones later. It also means the password you choose for every healthcare portal should be unique and strong, because the next listing could belong to any provider you use.

Actions you can take today

1. Change your ProSmile password immediately. Use a unique, randomly generated password you have never used on any other site. This is the single most useful step available while the facts remain unconfirmed.
2. Enable two-factor authentication on the ProSmile patient portal if the option exists. Even if the current password may have been exposed, a second factor blocks most direct account takeover attempts.
3. Review recent statements from any insurance provider linked to your ProSmile account. Look for claims you did not file or addresses that do not match your own. Early detection of fraudulent use of your insurance information is more practical than trying to prevent every possible misuse.
4. Place a fraud alert with the three major credit bureaus. This adds an extra verification step if someone attempts to open accounts using your name and date of birth. It is a low-effort, reversible measure that remains useful long after this particular listing fades.
5. Monitor your accounts for unusual login attempts or password-reset emails over the next several weeks. Treat any unexpected communication from ProSmile or connected insurance carriers as suspicious until you verify it through a known contact method.

If you maintain accounts at other dental or medical providers, repeat the password-change step there as well. Reusing credentials across healthcare sites turns one potential incident into many.

GalaxyWarden provides continuous monitoring across 13.1 billion breach records and more than 100 platforms, along with identity-chain mapping and remediation support by specialists.