T Smiles Dental Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have visited T Smiles Dental may now face uncertainty about whether their personal or clinical information has been taken by criminals. On 25 December 2024 the practice appeared on a listing associated with the rhysida ransomware group, which claims to have exfiltrated internal files. The number of individuals affected remains unknown, and public detail about the precise contents of those files is limited. For patients and staff, the practical stakes are clear: any exposure of medical, contact or financial data can create lasting risks of fraud, identity misuse or unwanted contact.

This article sets out only what has been reported, places the claim in the context of how rhysida typically operates, and outlines the concrete steps people can take while further information is awaited.

What happened

According to the available record, T Smiles Dental was listed by the rhysida ransomware group on 25 December 2024. The group claims that internal files were exfiltrated in a ransomware attack. No confirmed figure for the number of people affected has been published, and details of the intrusion method, the exact date of the compromise, or any ransom demand remain undisclosed. The listing itself constitutes a claim by the threat actor rather than an independently verified confirmation of the full scope of the incident.

Public reporting at this stage does not describe whether systems were encrypted, whether backups were affected, or whether the practice has issued a formal notification to patients or regulators. Until those points are clarified by the organisation or by official sources, the known facts are limited to the date of the listing and the assertion that internal files were taken.

Inside rhysida

Rhysida is a ransomware operation that has been active since mid-2023 and is known for double-extortion tactics. The group typically gains access to networks, steals data, encrypts systems, and then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. Listings on that site are used both as pressure on the victim and as a public claim of success. Rhysida has previously targeted healthcare providers, educational institutions and other organisations that hold sensitive personal records, often advertising the volume or type of data it says it holds.

The group’s public communications usually frame each listing as proof of a successful intrusion and data theft. In the case of T Smiles Dental, the only specific claim recorded is that internal files were exfiltrated. No further statements attributed to rhysida about this particular victim—such as sample files, patient counts or ransom amounts—appear in the available facts. Readers should therefore treat the listing as an unverified assertion pending independent confirmation.

Who is T Smiles Dental?

T Smiles Dental is a dental practice that has operated in Tottenham since 2018. Like most dental surgeries, it provides routine and specialist oral-health care to local patients and therefore maintains records that typically include names, addresses, dates of birth, medical and dental histories, treatment notes, appointment details, and sometimes payment or insurance information. Staff records and internal administrative files would also form part of its normal data holdings.

A breach involving a dental practice is consequential because the information is both personal and medical. Even limited clinical notes can reveal health conditions, medications or family circumstances that individuals reasonably expect to remain private. The practice’s relatively recent establishment does not change the sensitivity of the data it holds; any unauthorised access can affect current and former patients as well as employees.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of those files—such as patient charts, billing records or staff documents—has been disclosed. Organisations of this kind ordinarily hold a range of sensitive material. The exact contents of the files claimed by rhysida remain unconfirmed.

• Patient demographic and contact details
• Dental and medical history notes
• Appointment and treatment records
• Billing, insurance or payment information
• Staff and administrative documents

Until the practice or an investigating authority releases a verified inventory, it is not possible to state which of these categories, if any, were actually taken. The claim of “internal files” is the sole description provided.

What's at stake

For individuals, the primary risks are identity fraud, targeted phishing that uses genuine personal details, and the potential misuse of health information. Medical data cannot be changed like a password; once exposed it can be reused indefinitely. Even if financial account numbers are not present, knowledge of a person’s dental provider, address and date of birth can help criminals craft convincing scams or open new accounts.

For the practice itself, the incident raises operational, regulatory and reputational considerations. Healthcare providers are subject to data-protection rules that require prompt assessment and, where thresholds are met, notification of affected individuals and authorities. The absence of a published patient count does not remove those obligations; it simply means the scale of any required response is still being determined. Restoring systems, investigating the intrusion and supporting patients all consume resources that a small practice may find significant.

Were you affected?

If you have been a patient or employee of T Smiles Dental, treat the possibility of exposure seriously even while official confirmation is pending. Monitor bank and credit statements for unexpected activity, be cautious of unsolicited emails or calls that reference dental care or personal details, and consider placing fraud alerts with credit-reference agencies if you are concerned. Keep records of any communications you receive that appear related to the incident.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a scan will not confirm or rule out involvement in this specific incident, but it can indicate whether the same email has surfaced elsewhere and prompt earlier protective steps. Continue to watch for any formal notice from the practice itself, as that remains the most direct source of information about who is affected and what data may have been involved.

AICompiled with AI assistance from public sources and published under our editorial standards.