AI in Dental Care: AI Phishing’s Direct Path to Your Data

AI-generated writing programs are an exceptional tool for dental practices when communicating with patients. They make writing external correspondence, e-newsletters, social media posts, and marketing materials simpler than ever. These programs are an incredible timesaver for staff in any department, helping expedite projects and regular correspondence in a time-efficient manner.
The downside? Hackers are using the very same programs to initiate advanced cyberattacks.
The most common type of breach is stealing data for ransom, with over a quarter of businesses having to pay to get their information back in 2023. It’s important to note that hackers don’t only rely on AI hacking tools to access your system; most security breaches come directly from malicious messages known as phishing.
This leading cause of healthcare data breaches is used to inject malware into your network to conduct vast ransomware attacks. AI-aided attacks are primed to take the top spot in techniques used to escalate the frequency and skill of phishing attempts by utilizing new methods of building compelling content.
Phishing in an Era of Artificial Intelligence
We’ve all received questionable emails and texts written in poor English, with lousy grammar and strange email addresses, making them fairly easy to spot as fraudulent. Users often learn to identify phishing emails by looking for careless mistakes, but with help from AI-powered writing programs like Grammarly, ChatGPT, and Gemini, hackers now have the ability to deceive even the most tech-savvy individuals.
Another factor is the size of your “attack surface”—the bigger you are, the greater the risk. Each device and human represents a potential entry point for AI attacks. Considering the number of employees and entry points in busy dental and multi-location healthcare practices, AI phishing has made it easy for hackers to reach their intended targets. It only takes one click.
Seeing Through Misleading AI Messages
Whether through text, email, or other communication, once someone on your network clicks on the hacker’s cleverly disguised link, you are breached.
According to HIPAA Journal, 52% of IT professionals said they spend equal time dealing with phishing attacks as they do on other cybersecurity issues, and 37% said resolving phishing attacks is their most resource-consuming task. In 2023, phishing strikes comprised the highest number of complaints that the FBI Internet Crime Complaint Center (IC3) received. In fact, in the past 4 years, IC3 states phishing has been the category that receives the highest number of complaints annually.
But how does AI phishing work IRL? Here’s an example of an email generated in only 4 seconds by the free version of ChatGPT.
The program was asked to create a “short referral letter from a general dentist to an orthodontist with links to images.” Threat actors won’t need any advanced AI hacking tools to masquerade as a well-meaning colleague; they simply pop in the details of a local dentist and a known orthodontic practice, a fictitious patient name, and a malicious link, then send the content to the public email address listed on the orthodontist’s website.
Consider the finer details of the example below. Would your staff take the content at face value and click the malicious download link? What language and aspects jump out at you as suspicious?
[Name] [Title/Position]
[Dental Practice Name]
[Address] [City, State, Zip Code]
[Email Address] [Phone Number]
[Date]
[Orthodontist's Name]
[Orthodontic Practice Name]
[Address]
[City, State, Zip Code]
Dear Dr. [Orthodontist's Last Name],
I trust this letter finds you well. I am writing to refer my patient, [Patient's Full Name], to your esteemed orthodontic practice for further evaluation and potential treatment.
Upon my examination of [Patient's First Name], I have identified concerns related to [briefly mention the dental issues observed, e.g., misalignment, bite irregularities, etc.]. Given the complexity of [his/her] case, I believe that your expertise in orthodontics will be invaluable in addressing these concerns and achieving optimal oral health outcomes.
For your convenience, I have uploaded relevant images and records for your review. You can access these materials through the following link: [Link to Malware or Ransomware]. These visuals provide a comprehensive overview of [Patient's First Name]'s current dental status.
I appreciate your dedication to patient care and your commitment to delivering exceptional results. I am confident that your personalized approach to orthodontic treatment will greatly benefit [Patient's First Name].
Should you require any additional information or have any questions, please feel free to contact me at [your phone number] or [your email address]. I eagerly anticipate your expert assessment and recommendations for [Patient's First Name]'s orthodontic needs.
Thank you for your attention to this matter.
Sincerely,
[Signature]
[Typed Name] [Title/Position]
Defending Your Practice From Sophisticated Threats
The example above could easily deceive unsuspecting staff members when filled with the correct details. The days of catching improper grammar or sentence structure as signs of a phishing attempt are over. In this new age, it's crucial to equip your team with the necessary cybersecurity knowledge and AI technology to block hacking attempts effectively.
Thorough Employee Cybersecurity Training
Strong firewalls and virus protection measures play a crucial role in isolating attacks, but with over 60% of cyberattacks stemming from human social engineering — it is imperative to continually educate your staff on cyber threats. With employee cybersecurity training sessions for each facet of your practice, team members will be better equipped to identify and report suspicious communications.
For example, consider providing staff with the example above or another hypothetical AI phishing attempt and ask them what jumps out as a security risk. Common sense will likely catch a few spelling mistakes here and there, but a cybersecurity-focused mindset would quickly see an embedded download link as a prime opportunity to deliver malware.
Whether you partner with a cyber company who offers employee cybersecurity training or ask your internal IT team to create a training seminar or internal communication, any education on the growing threat of AI attacks reduces the odds of infiltration.
Working Alongside Cyber Response Experts
The best-case scenario is catching potential threats before hackers access a practice’s digital infrastructure, but what happens when an effective social engineering attempt pays off? At this stage, the time for employee awareness is up, and swift action must be taken to prevent patient and office data from falling into the wrong hands.
Incident response is best left to professionals who have the knowledge and expertise to properly react to an attack while protecting from further harm. When your practice is already in the midst of a data breach, hasty reactions may open your system to even more exploitation. If a hacker is sending shady ransomware demands in the form of cryptocurrency payments, inexperienced IT or practice administrators could unknowingly break the law when engaging in the transaction to gain access back.
The right cyber response team acts as the negotiator, investigator, and recovery specialist needed to aid dental groups while in the throes of a security crisis.
But support shouldn’t end there; providing a helping hand in the aftermath of an attack is vital to resuming normal practice operations as quickly and safely as possible.
The Future of Online Protection
With all this discussion of hackers furthering their malevolent agendas via AI, some believe a successful hack is inevitable. We disagree.
As black hat programs develop at an accelerated pace, so do the techniques used by cybersecurity pros. Black Talon remains at the ready with the most advanced cyber tools and experienced team, ready to shape the future of digital defense in the dental community. Continue to part 3 of our AI in Dental Care series for more details on how cybersecurity firms use AI to fight against these new threats.
More from the blog
AI in Dental Care: A Double-Edged Sword
Read MoreAI in Dental Care: How AI Cybersecurity Combats Emerging Threats
Read MoreAI in Dental Care: Your Battle Plan Against AI Hacking
Read MoreSubscribe to email updates
Stay up-to-date on what's happening at this blog and get additional content about the benefits of subscribing.