MMG Fusion Dental Management Platform Breach Exposes 2.66 M Patient Records
What Happened — In December 2020, the cloud‑based dental practice management service MMG Fusion suffered a data breach that released 2,660,295 unique accounts. Exposed data include patient names, dates of birth, genders, marital status, addresses, phone numbers, appointment details, and a subset of password hashes (bcrypt).
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of inadequate data‑access monitoring and insufficient evidence of credential protection—core elements of a continuous control‑assurance program.
- Demonstrable privacy‑control evidence (e.g., consent records, DSAR handling) is essential for audit readiness under HIPAA, GDPR‑type regimes, and for maintaining customer trust.
Who Is Affected — Dental practices and other healthcare providers that rely on MMG Fusion’s SaaS platform; downstream patients whose personal health information was disclosed.
Recommended Actions
- Verify that all stored passwords use strong, modern hashing (e.g., Argon2) and rotate any compromised credentials.
- Deploy continuous monitoring of data‑access logs and retain immutable evidence to satisfy privacy‑audit requirements.
- Conduct a privacy impact assessment, update consent mechanisms, and prepare breach‑notification documentation. Source: HIBP breach report
Technical Notes
- Attack vector not publicly disclosed; breach appears to involve unauthorized extraction of database records.
- Data types exposed: personally identifiable information (PII) and protected health information (PHI), plus bcrypt password hashes. Source: HIBP