If you’ve ever heard of the American Dental Association on Forbes, chances are it’s an article about oral health. This week, however, the ADA finds itself in the news after hackers broke into its networks and unleashed ransomware.

Hackers unleashed the malware over the weekend, forcing the ADA to take some critical systems offline. Web chat, email and phone services were all affected when the ADA investigated the situation.

The ADA website is currently live, although a banner has been added to the top of all pages stating “ADA is experiencing a cybersecurity incident. We appreciate your patience and are working to keep the systems working properly.

This banner is directly linked to a Gmail address, which seems to indicate that the organization is not yet convinced that it is safe to use its own ADA.org mailboxes.

beeping computer saw an email allegedly sent to ADA members. Like most messages sent at the start of a ransomware investigation, it attempts to paint a somewhat optimistic picture of events.

In particular, he states that the investigation has so far not revealed any theft of member data.

A new ransomware gang claimed responsibility for the attack appears to have contradicted this statement.

Black Basta’s team has already leaked 2.8 gigabytes of data it claims was stolen from ADA servers. There’s allegedly more where that came from too. The hackers claim to have stolen about 9 gigabytes in total.

Security researchers who have reviewed the data say it contains a variety of sensitive information. This includes W2 and other tax forms, financial spreadsheets, and private practice information.

This approach has become standard in high-profile ransomware incidents. Referred to as double extortion, criminal hackers have developed a habit of leaking or threatening to leak their victims’ data in addition to encrypting files so that they are unusable.

Some attackers have added another difficulty: corrupting or deleting savegames. With no reliable backups to restore from and the imminent threat of leaking sensitive information, victims may feel like they have no choice but to pay the ransom.

While the attack on ADA itself is worrying enough, it may just be the tip of the iceberg. If, in fact, the Black Basta gang really has several gigabytes of information on ADA members, follow-up attacks aimed directly at their practices could occur.