Eaglesoft software by Patterson Dental is a popular patient management system . But just as Justin Shafer had concerns about patient data security in Henry Schein 's Dentrix G5 software , he 's also had concerns about Eaglesoft , albeit for different reasons . Shafer contacted this site on February 6 and notified CERT of his concern : Eaglesoft does seem to use a Connection String in the registry , and this can be changed , but it must also be changed in the database , and I can promise you NOBODY will change this . Eaglesoft has been using " dba " as a username and " sql " as a password for years and years and years . Changing this involves a bit of work , most dental IT guys will not ever be asked to change the BACKEND database password . CERT has now issued a VU number for Shafer 's report -VU#344432 and will be contacting Eaglesoft to discuss the concern . Also of concern , in the process of looking into Eaglesoft , Shafer discovered that some of Patterson Dental clients ' patient databases were unsecured on Eaglesoft 's FTP server . DataBreaches.net sent a security alert / notification about the situation to Patterson Dental on February 6 , and receiving no substantive acknowledgement , emailed them twice more over the next few days . DataBreaches.net also notified or attempted to notify affected Eaglesoft clients to alert them that their patients ' data was exposed . Information provided by Shafer indicated that the exposed databases included two from Canadian dental practices , one from a U.S. dental group , and one from a U.S. dentist employed by Patterson : Timberlea Dental Clinic ( Alberta , Canada ): Approximately 2,300 patients had their information exposed , including patient ID , first and last name , age , responsible party , home telephone number , date of last visit , recall date , LPA , NPA , NRA , recall type , and recall status . DataBreaches.net attempted notification via their contact form but got no response . Shafer spoke to them a few days later . Dr. M Stemalschuk ( Canada ): There were two files . One was password - protected . The other was a zip file with an Eaglesoft database with health and insurance information on approximately 15,000 patients : name , date of birth , address , telephone number , gender , marital status , employer , insurance carrier , and insurance member ID . Shafer also noted 10 SSN . Note : DataBreaches.net did not contact this practice because they had no email address on their website or contact form . Shafer called them . Massachusetts General Hospital Dental Group had protected health information on some of its patients exposed in a transaction log . The data included patient first and last names , the provider 's name , the patient 's ID number , their date of birth , their Social Security number , gender , and chart ID number . All of the data were plain text . Shafer informs DataBreaches.net that there were 5,424 unique patient names in the database with 4,396 Social Security numbers . Their HIPAA compliance office thanked DataBreaches.net for notifying them and immediately launched an investigation . Rob McCanon ( CEREC specialist , Patterson Dental ): a directory of almost three dozen named patients from 2009 was exposed . The files were image files ( CDT ) , and the index was last updated in 2011 . Because Shafer did not download or explore any of the individual CDT files , it is not known whether the image files also contained PHI such as patient names or if they were only images . DataBreaches.net notified Dr. McCanon via email , but received no response or acknowledgement . By February 8 , the FTP server was taken offline , but Patterson Dental has not responded to inquiries from this site asking : For how long patient data had been left unsecured on the server , How this happened , How many patients , total , had PHI exposed or left vulnerable because of this error , What Patterson Dental was doing in the way of notification and harm mitigation , and Whether Patterson Dental would be reporting this incident to HHS . If Patterson Dental does provide more information or if any of the affected clients provide more details , this post will be updated . Correction : This post previously noted that Shafer had found 90 plaintext user passwords in Dr. Stemalschuk ' data . Post - publication , Shafer clarified that the plaintext passwords table found in Dr. M Stemalschuk ' database have been present in every Eaglesoft database he has analyzed , and that Eaglesoft version 17 and below stored these passwords in plaintext . There is no indication in this case , however , that Dr. Stemalshuk used these passwords . ;