Breach Disclosure: MMG Fusion

Breach Disclosure: MMG Fusion

On December 20th, 2020, a software platform for dentists and orthodontists, MMG Fusion, suffered a data breach. The data includes patient information and credentials including email addresses, full names, addresses, contact information and more. Over 14 million patient records were included in the breached database.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Review network logs for potential signs of compromise and data egress.
• Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

The hacker under the alias of pompompurin posted a thread on a popular cyber crime forum in January, 2021. In the thread they detail when the breach took place and the amount of information they included within the data breach package.

Figure 1: Post from pompompurin advertising MMG Fusion breach data

The CSV containing the breached data totals over 15 million lines. However, the author explains that after deduplication of data there are approximately 14,772,314 lines of unique patient data. Based on the breached data analysed, the package includes:

• Email addresses
• First Names
• Last names
• Home Addresses
• Personal and business contact numbers
• Dates of Birth
• Appointment history
• SMS Logs with message sent
• Patient review history
• Emails sent to patients