The use of artificial intelligence (AI) to target dental practices has been increasingly used to make familiar attack methods easier to scale. These practices are an attractive target because they hold sensitive patient information and insurance/payment details, often rely on several outside vendors and rarely have a dedicated IT team.

Attackers are not necessarily using AI to create new attack methods, but are leveraging the tool to increase the speed, personalization, quality, and volume of attacks. The result is that dental practices are more exposed than ever to bad actors.

There are now several new attack patterns, including:

  • Highly personalized phishing. Attackers can use public information from a practice website, LinkedIn, social media, staff bios, and online reviews to quickly create emails that sound like they came from a dentist, office manager, IT provider, lab, insurer, or referral partner.
  • AI-assisted impersonation and payment fraud. Generative AI makes it easier to mimic an executive’s writing style, generate believable invoices, and create convincing text or voice impersonations. In a dental setting, the likely targets include payroll changes, wire/ACH requests, supplier payments, refunds, insurance communications, and requests purportedly coming from the practice.
  • Faster reconnaissance and vulnerability discovery. AI can help an attacker collect information about a practice’s exposed systems, software, vendors, and employees and assist with analyzing potential vulnerabilities.
  • Lower barrier to malware and ransomware operations. AI doesn’t magically create access to a dental network, but it can help less-skilled criminals write or modify code, troubleshoot attack tools, and produce the material that delivers malicious software.
  • Attacking the practice through third parties. Dental offices depend heavily on practice-management systems, cloud services, imaging platforms, labs, billing vendors, MSPs, and other business associates. An attacker who compromises one trusted relationship can create unusually believable communications or potentially reach multiple practices.