October 2026 by Tony Phung.
Canadian dental clinics use CDA Secure Send every day to share x-rays and referrals. In early October 2026, CDA reported a cyber-security incident and took the service offline. Here is what that means in plain words, and what to do while it stays down.
What did CDA report?
CDA reported that dentists received suspicious messages through Secure Send. Access used stolen usernames and passwords that appear to have come from an external source. Unauthorized messages with a harmful attachment went to dentists representing fewer than 10% of Secure Send subscribers. Dentists whose accounts appeared in those messages were notified.
CDA’s investigation found that no patient information, confidential information, or CDA Digital Certificates were accessed. Dentist information involved was limited to names and office addresses. The incident involved compromised user credentials. CDA reported that the Secure Send platform itself was not compromised.
The service remains offline while CDA adds safeguards. CDA expects it to be available by the end of October. That timing may change.
Why did a password alone get through?
Clinics trusted Secure Send for a reason. It is the official path many offices use. Credential theft still worked because multi-factor authentication (MFA) on Practice Support Services was available but optional. A stolen password, often reused from somewhere else, was enough.
CDA has said MFA will become mandatory for all PSS use when the service returns. That is the right move. Until then, and for every other login your clinic uses, a password alone is a weak door.
What should clinics do right now?
CDA’s own reminders match what we tell every clinic we support:
- Update passwords on PSS and any account that shared the same password.
- Do not reuse passwords across tools.
- Sign up for MFA when it is offered, and turn it on everywhere you can (email, remote access, practice software).
- Give staff their own PSS accounts instead of sharing one login.
Use a password manager
The practical way to stop reuse is a password manager. We recommend Bitwarden. Each person gets unique, long passwords they never have to memorize, and the team can share clinic logins without writing them on a sticky note.
Benson Hunt is a Bitwarden reseller. Our IT specialists can set it up for the clinic, walk your team through it, and keep MFA and password hygiene part of the ongoing plan.
Consider passkeys too
A passkey is a login that uses your phone or laptop unlock (Face ID, fingerprint, or PIN) instead of typing a password. Nothing reusable gets written down or reused on another site.
That helps against stolen-password attacks like the CDA Secure Send credential incident. A stolen password only works when the login is a password. Passkeys are phishing-resistant: a fake login page cannot trick you into handing one over the way a password can.
Turn passkeys on where your tools support them, especially Google Workspace and Microsoft 365. Keep MFA and a password manager like Bitwarden for everything else. Not every dental vendor offers passkeys yet, so use them where you can and stay with MFA plus unique passwords for the rest.
Is basic dental IT security enough?
No. A vendor login, antivirus, and a firewall are a start. They are not enough if passwords are shared, MFA is off, and nobody owns the day to day habits. As the custodian of patient information, the clinic still needs controls it can run itself: unique passwords, MFA, tested backups, patching, and clear rules for who can access what.
What Benson Hunt covers, and what we flag
We cover what the clinic can control: devices, email, backups, network, password managers, MFA, and staff habits. When an official third party such as CDA Secure Send is part of the workflow, we still flag the risks so you know where your responsibility ends and theirs begins. We cannot run CDA’s systems. We can make sure your side is not the weak link, and that you have a plan when a shared tool goes offline.
What can clinics use instead of CDA Secure Send right now?
Referrals and x-rays still need to move. Clinics already on Google Workspace or Microsoft 365 can use built-in encryption options as a bridge. Those tools help, with real limits. For larger images and a cleaner handoff, encrypted time-limited file links often work better.
Google Workspace Confidential Mode
If your clinic uses Gmail through Google Workspace, Confidential Mode lets you set an expiry, revoke access early, and turn off forward, copy, print, and download for the recipient. You can also require an SMS passcode. Recipients who do not use Gmail open the message through a link and passcode flow, so staff on both sides need a quick walkthrough.
It is a useful stopgap for short notes and smaller attachments. It is not a full substitute for every patient-record transfer. Provinces and colleges still expect you to judge whether the method fits the record and the recipient. Screenshots and photos of the screen can still happen. Treat it as controlled email, not a dedicated imaging exchange.
Microsoft 365 encrypted email
On Microsoft 365, Microsoft Purview Message Encryption (the current name for what many still call OME) and sensitivity labels can encrypt outbound mail. Options such as Encrypt-Only and Do Not Forward limit forwarding, printing, and copying where the recipient client supports them. Labels can also set access to expire after a date or a number of days.
External recipients often open the message through Microsoft’s encrypted message portal. That works well when both sides expect it. It can confuse a busy referring office that has never seen the portal before. Advanced expiry and revoke controls for outsiders usually need the right Microsoft licensing and admin setup. Ask your IT specialist before you rely on this for daily referrals.
Encrypted, time-limited file links
For documents and x-rays, Benson Hunt can set up encrypted, time-limited (ephemeral) file links. The file expires after use and is not left sitting in an open inbox. Clinics keep a clear send path while Secure Send is offline, without asking the other office to learn a new email portal overnight.
Why hire an IT team for secure clinic communications?
One vendor tool going offline should not stop care. An IT team that owns secure clinic communications end to end sets MFA, a password manager such as Bitwarden, encrypted send workflows, and short staff training. When Secure Send or another shared service drops, you already have a tested path instead of scrambling.
That is the work Benson Hunt does for dental clinics. We cover what the custodian can control. When an official party runs the tool, we still tell you the risks in plain words.
Need a practical send path while Secure Send is down? We can set up encrypted, time-limited file send for your clinic this week.
Or call (604) 813-7881 and ask for Tony. No pressure, no jargon. See also our notes on dental cybersecurity.
