Everything in this walkthrough is based on legitimate penetration testing techniques and common configuration weaknesses found during authorised security assessments of healthcare practices. No real patient data was accessed or exposed. Names and specifics have been generalised. The purpose is to show practice owners what an attacker sees — so you can close those doors before someone unauthorised walks through them.
I Know Your Practice Because I Work In One
Most cybersecurity writing about healthcare talks about hospitals, enterprise networks, and six-figure security budgets. That's not you. You have a reception desk, two or three treatment rooms, a server PC in the back office that nobody touches, and an IT guy who comes in when something breaks. You have between one and five support staff who have worked with you for years and would never intentionally compromise your practice.
And yet, from a security standpoint, your practice is one of the most accessible targets I encounter. Not because you've done anything wrong. Because the way a dental practice is physically laid out, and the way small practice networks are typically built, creates a set of entry points that an attacker can chain together in minutes.
I know this because I walk through the same door your patients do. I sit in the same chair. I look at the same bracket table, the same USB hub, the same wall where the WiFi password is written in marker. And I know exactly what I could do with it.
Here's what that looks like — from first step through the door to full access to every patient record in your system.
The Three Things That Make This Possible
Before we walk through the timeline, understand that this attack doesn't rely on any obscure software exploit or nation-state tooling. It relies entirely on three configuration realities that exist in the majority of small dental practices — and probably yours.
Look down next to the dental chair. In most modern practices there's a USB hub or charging station mounted at the base of the bracket table or integrated into the chair-side unit. It's there so patients can charge their phones during treatment. It's a thoughtful touch. It is also a direct hardware connection to the chair-side PC that controls your digital X-ray system, your treatment note software, and your practice network.
A USB Rubber Ducky is a commercial penetration testing device — available for around $60 — that looks exactly like an ordinary USB flash drive. The moment it's plugged in, Windows recognises it as a keyboard (not a storage device, so USB storage blockers don't help). It then types a pre-loaded keystroke payload at speeds no human could match — typically several hundred keystrokes in under ten seconds — launching a command prompt, downloading a script, and establishing a remote connection, all before the operating system has finished showing the "device connected" notification.
The attacker plugs it in. The dentist is gloved, focused on the patient's mouth, and wouldn't notice if someone reached across to the bracket table. In a single-handed practice the receptionist is at the front desk. The payload runs in silence. The device is removed. Eleven seconds of physical access and the attacker has a persistent foothold on a machine inside your network.
The waiting room WiFi password is on the wall. Sometimes it's on a small sign at the reception desk. Sometimes the receptionist just tells you. This is normal and it's fine — patients need internet access, and you want to provide it. The problem is not the password on the wall. The problem is what network that password connects to.
In most small practices, there's one router, one WiFi network, and everything is on it: patient phones, staff laptops, the reception PC, the chair-side PCs, the server. When a patient connects to your WiFi, their device is on the same network segment as every other device in your practice. They can — if they know what they're doing — see and attempt to communicate with all of them.
An attacker sitting in your waiting room with a laptop can run a passive network scan without sending a single packet that looks suspicious. Within two minutes they have a complete list of every device on your network: IP addresses, device names, operating system fingerprints. They know you have a PC named SURGERY-PC-1, a server named PRACTICE-SERVER, and a workstation running an older version of Windows because the imaging software vendor hasn't certified the latest OS release yet.
A "flat network" means every device can freely communicate with every other device. There's no firewall rule saying the reception PC can only talk to the booking server. There's no policy preventing a chair-side PC from accessing the accounts folder on the server. If you're on the network — whether legitimately or not — you can reach everything on it.
This is how small networks are typically set up, because it's simpler and cheaper and there's no IT complexity to manage. But it means that the moment an attacker has a foothold on any machine — through the USB hub, through the WiFi, through a phishing email — they can immediately attempt to access every other machine. There's no internal wall to stop them.
Combined with the reality that practice management software typically runs on a shared server with network file shares accessible to all PCs, and that staff user accounts frequently have broad permissions because it's easier to give everyone access than to manage individual permissions — a flat network turns one compromised endpoint into full practice access within minutes.
The 11-Minute Timeline
Here's what happens when you chain those three findings together. This is a realistic sequence based on documented penetration testing methodology. Every step uses real, legitimate security testing tools and techniques. The times are conservative estimates based on a typical small practice network.
The USB attack requires a moment of physical access. But remember: an attacker sitting in your waiting room on your shared WiFi has a network-level vantage point from which they can attempt the same network scan, the same share enumeration, the same credential discovery — all without ever touching your hardware. The USB path is faster. The WiFi path requires no physical contact at all. Both end in the same place.
What This Means Under POPIA
At the eleven-minute mark, you have a notifiable security compromise under Section 22 of POPIA. Patient records — including health information, which is special personal information under Section 26 and carries heightened protection obligations — have been accessed by an unauthorised person. It doesn't matter that you didn't know it happened. It doesn't matter that nothing was visibly damaged. The access event itself is the breach.
Your obligations from that point are: notify the Information Regulator as soon as reasonably possible, notify every affected data subject, document the circumstances, and demonstrate what reasonable security measures you had in place at the time. A USB hub physically accessible to patients, a flat network with no segmentation, and shared WiFi with no guest isolation are three findings that make "reasonable security measures" a very difficult case to argue.
The exposure isn't theoretical. Dental patient records contain some of the most personally identifiable data in healthcare — medical history, chronic conditions, medications, ID numbers, photographs. In a practice of any size, that's hundreds or thousands of people whose information you hold and are legally responsible for protecting.
Five Fixes. None of Them Are Expensive.
The good news is that nothing in this scenario requires a security overhaul. Each of the three underlying weaknesses has a specific, practical remedy. Here they are.
A Note From One Dentist to Another
I wrote this article because I've sat in that chair. I know the pressure of a full appointment book, an unhappy patient in room two, a receptionist calling through the intercom, and a phone that won't stop. The last thing on your mind during a clinical day is network segmentation.
But I also know what's on that server. I know you have years of patient records, treatment histories, X-rays, accounts, staff details. I know how long it took you to build that patient base and how much trust each one of those records represents. And I know that under POPIA, you are the responsible party — the Information Officer — for every single one of them.
None of the five fixes above require you to become a cybersecurity expert. They require one conversation with your IT provider, who should be able to implement all of them in a single half-day visit. The USB charging solution costs under R200. The guest WiFi costs nothing — it's already in your router. The peace of mind that comes from knowing your patient data is actually protected, not just probably protected, is worth considerably more than that.
Book a Dental Practice Penetration Test
We assess dental practices specifically — including physical security, network architecture, WiFi isolation, and staff awareness. You get a written findings report and a remediation plan you can hand to your IT provider. Conducted by a dentist who understands your clinical environment.
Practicing dentist and independent cybersecurity practitioner based in Umhlanga, South Africa. Founder of Greyhat4Hire. Specialises in penetration testing of healthcare and dental practices — with the unique advantage of knowing exactly what your clinical environment looks like from the inside.
About Dr Sykes →