Ransomware for Under R80:
Why Your Dental Practice
Is the Perfect Target

The R80 Problem

Picture the kind of criminal who used to threaten your practice. You'd imagine someone technically sophisticated — a seasoned hacker who spent years learning the craft. That person still exists. But today they've been joined by tens of thousands of others who need nothing more than a browser, a cryptocurrency wallet, and less than $5.

The dark web has industrialised cybercrime. Ransomware is no longer a weapon — it's a product. And like any successful product, it's been packaged, marketed, and sold with customer support, reviews, and money-back guarantees. The barrier to launching a ransomware attack against your practice is now lower than the barrier to booking a patient appointment online.

This isn't a distant hypothetical. It is the current reality of the threat environment your practice operates in, right now, in South Africa.

What You're Actually Buying

The model behind cheap ransomware is called Ransomware-as-a-Service (RaaS) — and it mirrors legitimate software business models more closely than you might expect. A developer creates the malware, hosts the infrastructure, and offers it to "affiliates" who handle the deployment. Revenue is split, typically 70–80% to the affiliate and 20–30% to the developer.

For under R80, an affiliate can access a basic kit. For R150 - R500, they get a polished package that includes:

• A pre-compiled malware binary that encrypts files using AES-256 or ChaCha20 — the same algorithms used in legitimate security software
• An auto-generated ransom note, customisable with the victim's name and a payment deadline
• A command-and-control (C2) panel accessible via Tor, showing which victims have been infected and which have paid
• Automated cryptocurrency payment processing — no manual involvement needed from the attacker
• Evasion techniques that attempt to disable Windows Defender and shadow copy backups before encryption begins

What makes this especially dangerous is that the attacker running the campaign might be a 19-year-old with no technical background. The expertise is baked into the product. They don't need to understand encryption — they just need to press send on a phishing email.

Why Dental Practices Are the Perfect Target

You might assume that hospitals and large medical aid schemes are the primary targets. They are targeted — but they also have dedicated IT security teams, enterprise-grade firewalls, and compliance officers. Your practice, by contrast, offers attackers a much more attractive proposition: extremely valuable data, with significantly less protection.

Patient Data Is Worth More Than Financial Records

This is well-documented in cybersecurity research: stolen health records command significantly higher prices on dark web markets than stolen credit card numbers. A card gets cancelled within days. A full health record — name, ID number, medical history, contact details, medical aid membership — remains exploitable for years. It can be used for identity fraud, insurance fraud, and highly targeted scams that are far harder for victims to detect than a fraudulent transaction.

Exact prices fluctuate and vary widely by market and data quality, so it would be misleading to quote a specific figure here. What is consistent across the research is the relative value gap: health data is treated as a premium commodity, and smaller healthcare providers — who hold real patient data but typically lack enterprise security — are an attractive proposition for that reason.

Why Attackers Choose Healthcare Over Banks

There's a second reason dental practices are favoured targets — and it's purely operational. Ransomware attackers are rational. They attack targets that are likely to pay, quickly, without much resistance. Dental practices and small healthcare providers have historically shown a very high payment rate because:

• Operational dependency is immediate. You cannot see patients without access to records, X-rays, treatment histories, and appointment schedules. Every hour of downtime is direct revenue lost, plus reputational damage to patients who arrive for appointments and are turned away.
• Backup practices are typically weak. Most practices rely on in-system backup features within their dental software, which are often the first thing ransomware disables. Offsite, air-gapped backups are rare at the small practice level.
• There is no dedicated IT security response. When a large bank is hit, a security operations centre engages within minutes. When your practice is hit at 2am, you call the dental software support line in the morning — and discover they can't help because the files are encrypted.
• The ransom amounts are calibrated to be affordable. Attackers targeting small practices typically demand R15,000–R80,000 — painful, but less than the perceived cost of downtime, data loss, and legal exposure. This is a deliberate pricing strategy.

How an Attack Actually Unfolds

Let's walk through a realistic illustrative scenario — not a documented incident, but a composite that reflects how these attacks typically unfold at a small practice. Two dentists, a reception PC, a few workstations, and a server running their practice management software. Tuesday morning, 7:52am.

What Prepared Actually Looks Like

Good news: you do not need a large IT budget or specialist staff to significantly reduce your risk. What you need is a structured approach applied consistently. These are the controls that matter most for a dental practice of any size.

1. The 3-2-1 Backup Rule — Non-Negotiable

Three copies of your data. Two on different media types. One stored offsite or in the cloud with versioning enabled. The offsite copy must be air-gapped — not connected to your practice network — so that ransomware cannot reach it. This single control is the most effective recovery tool available. A tested daily backup means ransomware becomes an inconvenience rather than a catastrophe.

2. Multi-Factor Authentication on Everything External

Remote desktop access, your practice email, your cloud storage, your dental software web portal — any service accessible from outside your building must require MFA. The most common initial access vector for small practice attacks is compromised email credentials obtained from previous data breaches. MFA stops credential theft from becoming a foothold, even if the password was already stolen.

3. Patch Management — Set It and Actually Run It

Ransomware frequently exploits known vulnerabilities in unpatched Windows systems. Most small practices disable automatic updates because they fear disrupting the dental software. The risk calculus here is badly skewed: the disruption from an unexpected reboot is minutes. The disruption from ransomware is days to weeks. Enable automatic updates. Test your dental software after updates. Accept the minor inconvenience.

4. Staff Awareness — Your Biggest Risk and Your Best Defence

The vast majority of ransomware enters a network the same way it entered the practice in our scenario: through a phishing email opened by a staff member. Training doesn't need to be complex. Your team needs to know three things: never open unexpected attachments, verify unexpected requests by calling the sender on a known number, and report anything suspicious immediately without embarrassment. Creating a culture where staff feel safe reporting a suspicious click — rather than hiding it — is the single most operationally valuable security behaviour you can instil.

5. An Incident Response Plan — Even a One-Page One

When ransomware hits, panic is expensive. A simple written plan that covers who to call, what not to do (don't try to decrypt files yourself, don't pay without legal advice), how to isolate affected machines, and what your POPIA notification obligations are — reduces response time and decision quality dramatically. You do not need a sophisticated document. You need something that exists and that your staff know about.

Your Action Plan

The threat is real, it is cheap to deploy, and dental practices are explicitly valued targets. But this is not a situation where you need to be afraid — it is a situation where you need to be prepared. The difference between a practice that survives a ransomware incident and one that doesn't is almost never budget. It is almost always preparation.

As someone who has spent two decades in both dentistry and cybersecurity, I can tell you that the security posture of the average South African dental practice is significantly below where it should be — not because practitioners don't care, but because the threat has been allowed to feel abstract. It isn't. The tools to attack your practice are cheaper than your morning coffee. The tools to defend it are not expensive either — but they require intention and action.

If you are uncertain about where your practice stands, a structured risk assessment will identify your specific exposures, prioritise remediation by impact and cost, and give you a clear, actionable roadmap. It does not require bringing in a team of people, shutting the practice down, or spending large amounts of money upfront.

The question is not whether practices like yours are being targeted. They are. The question is whether yours will be worth attacking when the scan hits it.