iDentalSoft Ransomware Claim by Termite (Oct 2026)

Claim Summary

On or around October 9, 2026, a ransomware group calling itself “termite” allegedly listed iDentalSoft, a Brazil-based healthcare software vendor, on its dark web leak site. According to the threat actor’s claim, the company was added as a victim on that date. The group has purportedly not disclosed the volume of data it claims to hold.

iDentalSoft provides a cloud-based dental practice management platform marketed as secure and modern, offering smart scheduling, advanced clinical charting, and patient communication tools for single and multi-practice dental operations. The sensitivity of this sector, combined with the vendor’s role as a software provider to dental clinics, makes the claim notable if it proves accurate.

This report is based solely on the threat actor’s unverified assertion. Yazoul Security has not independently confirmed the intrusion, the exfiltration of data, or the authenticity of any listing.

Threat Actor Profile

The group operates as termite, a ransomware operation with no established public research footprint at the time of writing. Key intelligence gaps include:

• Total known victims: Unknown. No reliable victim count is available from open sources.
• Known tools: Unknown. No tooling, malware families, or affiliate structure have been publicly documented.
• Research references: None available. The absence of prior reporting means we cannot assess historical targeting patterns, negotiation behavior, or typical ransom demands.

Because termite lacks a documented track record, its credibility cannot be meaningfully rated. Newer or rebranded groups frequently exaggerate victim counts and data volumes to manufacture leverage and pressure targets into paying quickly. The absence of a stated data volume in this claim is itself notable - it may indicate an early-stage listing, an opportunistic claim, or simply a deliberate withholding tactic.

No YARA rules or detection signatures specific to this group are publicly available. Analysts should rely on generic ransomware detection guidance, including monitoring for unusual data staging, mass file access, and outbound transfer anomalies.

Alleged Data Exposure

The threat actor has allegedly claimed iDentalSoft as a victim but has purportedly not published a data volume, sample files, or proof-of-exfiltration details in the information available. No data samples, credentials, patient records, or download references are included in this report, and none should be sought.

If the claim is accurate, the nature of iDentalSoft’s business - cloud-hosted practice management for dental clinics - could imply exposure of scheduling data, clinical charting records, and patient communication logs. However, this is speculation based on the company’s stated product scope, not on verified evidence. The group has provided no proof to substantiate any specific data category.

Potential Impact

Should the claim prove accurate, downstream effects could extend beyond iDentalSoft itself. As a software vendor, the company may serve numerous dental practices, meaning any confirmed compromise could have supply-chain implications for its customers. Healthcare data carries regulatory weight in Brazil under the LGPD, and affected clinics could face notification obligations.

That said, ransomware groups routinely overstate impact. A listing alone does not confirm data theft, encryption, or operational disruption. Until independent verification occurs, the practical impact remains unknown.

What to Watch For

• Any official statement from iDentalSoft confirming or denying the incident.
• Publication of data samples or proof-of-exfiltration by the termite group.
• Additional victim listings from termite that could establish a pattern or targeting preference.
• Brazilian data protection authority (ANPD) activity or breach notifications from affected dental practices.
• Emergence of termite in third-party ransomware tracking and research feeds.

Organizations in the healthcare software sector should review third-party risk exposure, verify backup integrity, and ensure incident response playbooks account for vendor-side compromises.

Disclaimer

This report is based entirely on an unverified claim published by a ransomware threat actor. Yazoul Security has NOT independently confirmed the attack, the exfiltration of data, the authenticity of the listing, or any details provided by the group. Ransomware operators frequently exaggerate or fabricate claims to pressure victims. Nothing in this report should be treated as established fact. Readers should await official confirmation from iDentalSoft or relevant authorities before drawing conclusions.