A UK dental group with more than 250,000 patients has confirmed that some patient and staff data was exposed online after it moved data to a server in the US.
The researcher who found it says the database sat unsecured for almost nine months. Five months after the company was told, patients still hadn't been contacted.
It's a story about two blind spots plenty of small businesses share: not knowing what you've left open on the internet, and not knowing what to do when you find out.
What happened
According to an investigation by The Detail published on 4 November, Smart Dental Care runs 31 practices across England, Northern Ireland and Dublin, with nine in Northern Ireland.
Cyber researcher Kevin Logan says patient and staff data was left unsecured online from September 2025 to May 2026. He contacted the company in late May, and the database was secured six days later. The company confirmed an "exposure of some patient and staff data" and said it acted as soon as it became aware.
Staff were told. Patients were not, because the company says the breach "consisted of very partial information". Logan says the records included names, dates of birth, addresses and clinical records, though The Detail notes it hasn't independently verified that.
The ICO closed its first look at the case in late June after giving data protection advice. In September it said it had received new information and would assess it again. Ireland's Data Protection Commission is engaging with the company, and Northern Ireland's Department of Health has asked it for formal assurance.
How data ends up open on the internet
Nobody had to break in here. This kind of exposure usually happens during a change: data is copied to a new server, cloud database or storage bucket, and access is left open or never checked. The system works, so nobody looks again.
It's far more common than most people think. A Ransomnews index reported by Security Affairs on 29 October counted 484,142 publicly listable cloud storage buckets holding 18.05 billion files. Among them were 321,058 files linked to credentials and keys and about 4.7 million database and dump files. Buckets with healthcare-related names alone held 47.9 million files. Some of those buckets are public on purpose, and the counts are based on names rather than confirmed owners, but the scale makes the point.
The second mistake: staying quiet
Under Article 33 of the UK GDPR, an organisation must report a personal data breach to the regulator "without undue delay and, where feasible, not later than 72 hours after having become aware of it", unless it's unlikely to result in a risk to people. Every breach must be documented, including the facts, effects and what was done about it.
Article 34 adds that when a breach is likely to result in a high risk to people, you must tell them without undue delay. Open Rights Group's Mariano delli Santi told The Detail that if the researcher's claims hold, it would be "very difficult for the clinic to argue" the threshold wasn't met.
We don't know the full facts of this case. The lesson for everyone else is simpler: make the decision quickly, and write down why.
What this means for UK small businesses
If you've moved to a cloud booking system, swapped practice or customer software, or had an IT supplier set up a new server, you've been through the same kind of change. Your supplier may have done the work, but the customer data is still yours to protect.
This company heard about its exposure from a stranger. The best case is a friendly researcher. The worst case is a criminal who finds it first and says nothing. And when names, dates of birth and addresses leak, the scam calls and emails that follow sound convincing.
What to do this week
List where customer data lives. Booking system, accounting software, email, shared drives, backups and any cloud storage. If you can't list it, you can't check it.
Check anything that's moved recently. Any migration in the last year deserves a second look: is the old copy deleted, and is the new one password-protected and private?
Ask your suppliers one direct question. "Is any of our data reachable from the internet without a login, and how would you know?" Get the answer in writing.
Write a one-page breach plan. Who decides, who calls the ICO (helpline 0303 123 1113), how you'll tell customers, and where you'll record what happened. Remember the 72-hour clock.
Make it easy to report a problem. Put a security contact email on your website so anyone who spots an issue can reach the right person fast.
Sophia Says
This one frustrates me because it's so avoidable. Nobody cracked a password or wrote clever malware. Data was moved, left open, and sat there for months. Then the harder conversation, telling patients, was put off. Most businesses I talk to would never knowingly do either. They just don't have a view of what's facing the internet, so they find out from someone else.
That's exactly the gap HackRisk closes. We look at your business from the outside, the way a researcher or attacker would, and tell you in plain English if a database, storage bucket or forgotten server is open. If your details turn up somewhere they shouldn't, we flag that too, so you can act in hours, not months. You can't protect what you can't see.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Exposed databases and servers: Recon Scan maps what your business has facing the internet, including things you'd forgotten.
Misconfigurations and weak spots: Vulnerability Scan checks those systems for known flaws and risky settings.
Leaked data: Dark Web Scan watches for your business's details turning up where they shouldn't.
Suppliers who hold your data: Supply Chain Risk helps you see which partners could expose you.
Staff who know what to do: Security Awareness Training helps your team recognise a breach report and escalate it quickly.
Find out what you've left open
Most exposures are found by whoever looks first. Make sure it's you. Get your free HackRisk report and see what your business looks like from the outside.
