Detailed staff records stolen by hackers from British Dental Association servers were leaked on the Dark Web soon after a massive cyber attack forced the Association to take some of its systems offline.
In mid-August, the British Dental Association announced that it suffered a "sophisticated cyber attack" that forced it to take some of its systems offline and to rebuild its systems on a new network to lower the risk of the malware responsible for the cyber incident.
"We have been working hard, alongside a number of third-party experts including forensic IT specialists, to determine the nature of the criminal activity. At present we don't know what information may have been compromised but we are working to conclude the investigations as soon as possible. However, the evidence now available suggests that the data extracted relates to a very small snapshot of the total data stored on our servers," the Association said, confirming that the attack did result in the loss of sensitive information.
British Dental Association added that it notified members and other contacts about this incident and also notified The Information Commissioner's Office and the police about the cyber attack affecting its systems.
A few days after the cyber attack took place, security firm Cyble said it came across a post in which a threat actor "claimed to be in possession of staff profiles of the British Dental Association and was sharing it for free".
In order to investigate the threat actor's claims, the security firm acquired the data and found that it contained a total of 172 data folders which further contained 5517 data files. These files contained Personally Identifiable Information (PII) of multiple employees along with their training materials, payroll documents, appraisals and benefits files, performance reports, etc.
The data files also contained details of 7 employees who were granted maternity leaves, details of employees' beneficiaries to whom the lump-sum death benefit will be shared, employee’s opting out of group pension scheme forms containing details like employee’s name, employer name, employee’s insurance number and DOB, as well as the British Dental Association's new employee information forms that contained detailed information of their new joining employees.
According to Martin Woodrow, the chief executive of British Dental Association, the association has been unable to confirm the full extent of information that had been accessed by hackers who carried out the cyber attack.
“We are devastated and apologise unreservedly for this breach. We have informed the Information Commissioner’s Office and we are contacting any individuals we think may be affected. Additionally, we are also working around the clock to restore and rebuild our systems. We will keep members updated as the situation develops,” he added.