CDA Secure Send Service Notice

October 6, 2026

Last Wednesday, the Canadian Dental Association (CDA) became aware that some dentists had received unexpected messages through Secure Send. The service was promptly taken offline and affected accounts were secured to contain the issue and support an investigation.

 Latest findings:

• The system was accessed using stolen valid credentials (usernames/passwords) that appear to have been obtained from an external source.
• The accounts were used to send unauthorized messages containing a harmful attachment to approximately 2,000 dentists, representing fewer than 10% of Secure Send subscribers.
• The investigation has found that no patient information, confidential information, or CDA Digital Certificates were accessed. The dentist information involved was limited to names and office addresses.
• Affected account holders and message recipients have been notified.

The investigation is continuing, and Secure Send will remain offline while additional safeguards are implemented.

Important next steps:

If you have a CDA Practice Support Services account:

• Change your password immediately to a unique password, never reuse an old or existing password
• Sign up for MFA on the PSS website. Using an authentication app on your mobile device is the most secure option and is highly recommended. 

If you received the Secure Send email message and downloaded the file:

• Do not open or execute the file. Delete it and any associated message.

If you opened the file and followed the instructions on the malicious website:

• As a precaution, disconnect the affected computer from the Internet or network and contact your organization's IT support or cybersecurity provider immediately. If you entered any account credentials after opening the file, change those credentials from a different, trusted device.

Your IT provider may recommend additional steps, including scanning the affected computer for malicious software.