Dental clinic cybersecurity is not an enterprise SOC - it is six practical habits: MFA on the practice-management system (CGM, Estomed, Kamsoft) and email, regular software updates, encrypted backup of medical records with an offline copy, segmenting X-ray devices from the reception network, brief team training on Polish-context phishing (fake NFZ emails), and one external vulnerability assessment per year. 80% protection in one week of work and under PLN 8,000 annually.
1. Why dental clinics are targeted
Three reasons dental clinics are over-represented among Polish SMB victims:
Market value of medical records. IBM Cost of a Data Breach 2024 puts the dark-web price of a full medical record at USD 250-500 per patient - roughly 50× a stolen credit card. A 500-patient practice represents around USD 100K in attacker revenue potential.
Time pressure. Encrypted medical records mean no appointments. A clinic can run in emergency mode for 1-3 days at most, then loses patients and revenue. Attackers know ransom payment comes faster here than in other industries.
Low baseline cyber hygiene. Most Polish dental practices lack in-house IT. The external technician shows up “when something breaks”, not preventively. MFA is not standard. RDP exposed for the manager’s remote work is common.
CERT Polska recorded dozens of confirmed ransomware incidents in the Polish healthcare sector in 2024; the report does not break down by entity type, but incident-response firms point to dental and aesthetic clinics as a top reporting category.
2. Three defence layers - applied to the dental clinic
Same three-layer model (access, data, anti-fraud), with dental specifics.
Layer 1 - Access to the practice-management system
MFA on the main CGM/Estomed/Kamsoft Dent account, MFA on business email (fake NFZ phishing is the most common Polish entry vector), monthly vendor patches with critical CVEs deployed within 7 days, separate logins for every employee (no shared “dentist1” account), 12-character passwords, 5-minute screen lock.
Layer 2 - Data: records and imaging
3-2-1 backup of medical records with one offline copy. RPO ≤24h, RTO ≤72h. Monthly restore test of one patient card + one X-ray. X-ray and CBCT devices on a separate VLAN - they typically run unpatched Windows. Patient Wi-Fi on a fully separate guest network. BitLocker at rest on every workstation.
Layer 3 - Anti-fraud
Polish-specific phishing patterns: “fake NFZ” (impersonating the National Health Fund), “fake Police” demanding patient data. SPF + DKIM + DMARC on the clinic domain (p=reject after 4-8 weeks of report collection). Written procedure for transfer verification via a second channel. Annual 3-hour team training + bi-monthly phishing simulations targeting <5% click rate after 12 months.
3. Compliance specifics
GDPR Article 9. Medical data = special category. Patient consent (treatment + separately for photo publication), information clauses, processing register, DPAs with the practice-management vendor, 20-year retention for medical records.
Medical secrecy (Polish Act on Physician Professions, Article 40). Parallel regime to GDPR. Violation of both = double liability (administrative + professional before the medical chamber).
NIS2 - almost never applies. Solo or 1-3 chair practices are out. A 10+ chair network with 50+ staff may qualify - run the scope test in the NIS2/UKSC pillar.
Not needed for a solo practice: ISO 27001 (only if a corporate client demands it), full SOC, dedicated SIEM, full-time security staff.
4. Budget
Annual ranges for a typical 1-4 chair practice, 1-5 staff, 2026 PLN, gross:
- 0-1,000 PLN/year: MFA on all accounts (free in Google Workspace or Microsoft 365), SPF/DKIM/DMARC, BitLocker, written policy.
- 1,000-3,000 PLN/year: Microsoft 365 Business Premium (~25-30 PLN/user/month, includes EDR), 2-bay NAS one-time 2,000-3,000 PLN, immutable cloud backup 50-150 PLN/month.
- 3,000-8,000 PLN/year: Annual CyberAudyt CyberCerber vulnerability assessment, phishing simulator, cyber insurance 1,000-3,000 PLN.
- Above 8,000 PLN/year: Multi-chair clinic. CyberAudyt or Pentest, retained SOC, DPO outsourcing (800-2,500 PLN/month).
5. 30-60-90 day plan
Weeks 1-2: Account inventory, MFA, domain breach check in Have I Been Pwned. Weeks 3-4: Backup 3-2-1, BitLocker, vendor patch schedule. Weeks 5-8: X-ray VLAN segmentation, guest Wi-Fi, SPF/DKIM/DMARC, written transfer-verification procedure, team briefing. Weeks 9-12: External vulnerability assessment (CyberAudyt CyberCerber), remediation of critical findings in 7 days, calendar entry for the annual audit.
After 90 days: three defence layers, GDPR Article 32 documentation, written incident-response plan.
6. CyberCerber for dental clinics
Fixed-price external vulnerability assessment for Polish SMB dental clinics. Polish-language report - readable by the dentist-owner, not just IT. Three products: PreScan (free diagnostic in 24h), CyberAudyt (full vulnerability assessment, report in 5 business days), Pentest (for larger clinic networks and regulated entities). Guarantee on CyberAudyt: if the report does not surface at least three actionable findings, full refund. Free PreScan - 24 hours, nothing to install. Pricing. Services page for dental clinics.
7. FAQ
(See faq field in frontmatter - 12 Q/A pairs.)