Ransomware (extortion): Dental practice, Germany
In a group practice with four dentists and 18 employees, someone opened an email attachment, whereupon a Trojan encrypted the IT and 10 Bitcoin (around 220'000 euros) were demanded.
- Incident · date unknown · Bavaria, Germany
- Evidence: one media report
- Ransomware (extortion)
- Phishing
- Data breach
As of
What happened
The practice paid and received the key, but personal data had already been exfiltrated and published on the darknet. The practice had to close completely for two weeks, lost patients and suffered a total loss of around half a million euros, most of which was covered by the cyber insurance.
- Affected
- Company (anonymous)
- Industry
- Dental practice
- Loss
- around EUR 500'000 (IT, restoration, extortion, business interruption)
- Business interruption
- 14 days
- Ransom demanded / paid
- yes / yes
- Data affected
- true
- Bankruptcy
- no
- Entry point
- Email attachment with the subject line «Proposed appointments for a professional dental cleaning»
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: yes, according to the source.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Proceedings before authorities
Costs of FDPIC or GDPR proceedings, usually not fines
Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Paying a ransom does not protect against the publication of stolen patient data; the consequential costs far exceed the ransom.
Sources
- Cyberangriff – und was nun? (MEDletter Ausgabe 1/2025) (opens in a new window) HDI Versicherung AG · 2025-05
«Infolge des Angriffs musste die Praxis zwei Wochen vollständig schliessen»