Cyberattacks on Dental!! Aspen Dental, Human Hacking and More with Jeff Hopeck

The following transcription was from the Bulletproof Youtube channel. Here is the https://www.youtube.com/watch?v=E_3YUFOcOac

Peter Boulden
0:00:00
because we have the ground game, we've actually built the practices that people aspire to

Peter Boulden
0:00:05
create. History will prove one of us correct. Wait, wait, wait, wait, you're not letting

Peter Boulden
0:00:10
me finish, bro. This is how you become Bulletproof. Bulletproof.

Peter Boulden
0:00:15
Hey everybody, welcome back to another episode of the Bulletproof Dental Practice Pod. Today I'm here with an old friend of mine. We go way back, way back, way back to probably 2007. And Jeff, I think our relationship started on Craigslist. Yes. Which is interesting because Craig and my relationship started on Instagram. So maybe that's a thing. Long running relationships. I just need to love it. Anyway, you had reached out to me maybe. Geez, well, how long was it? A couple of months ago when I think the Aspen dental crisis was going on and you're like, hey, have you heard of, you know, hacking and human hacking? And I was like, what? And I actually like, for the love of me, I thought human hacking. I was thinking, is he talking about like human trafficking?

Jeff Hopeck
0:00:56
Right.

Peter Boulden
0:00:57
Right? And I was like, human hacking? Actually, yeah. So, I mean, randomly, but who better to talk about security? Right? You're a former, you're a former secret service, right?

Jeff Hopeck
0:01:07
Yeah, secret service officer.

Peter Boulden
0:01:09
When did you do that?

Jeff Hopeck
0:01:10
Stationed at the White House. So, the years 2003, four, five, and six.

Peter Boulden
0:01:14
That's cool.

Jeff Hopeck
0:01:15
Yeah.

Jeff Hopeck
0:01:15
Oh, yep. Oh, three to six. And then as I mentioned in my text, Peter, and we'll get into it, I was unfortunately part of that massive OPM hack of 22.1 million records. And they've got every OPM.

Peter Boulden
0:01:28
Okay.

Jeff Hopeck
0:01:28
So yeah. So in 2015, it's basically the, the government agency. Office of personnel management that handles all aspects of security clearance. So all of the steps you have to go through. I mean, mine was almost two years long of test after test after test and fingerprints and you name it. Security clearance because you had a resident. Yes. And then in 2015, 2015, very famous case, a country that we don't need to name on here because you can read it yourself online, grabbed all of our stuff. It was a massive hack and they got 22.1 million files. So I had gotten an email, I had already been out. I started Killer Shark Marketing, already moved to Georgia and got what I thought was a spam piece of mail that I'm telling you most times I would throw away. And I read the first paragraph and I wasn't, my body wasn't sure how to react. I wasn't sure if I should go into like, whoa, freak mode or holy cow, this is spam in and of itself. But it was frightening. So basically what it said is every single thing that the government has on you that you went through for your clearance, all of the relationships you've listed, places you've lived, social security number, fingerprints, the list goes on and on and on. on a country, state sponsored terrorist country, used a group who's so sophisticated at hacking that got into our, again, it was the OPM and literally has everything.

Jeff Hopeck
0:03:01
Okay.

Jeff Hopeck
0:03:01
So you could stop right there and say, all right, yeah, big deal. Well, okay. So they have it. They're not going to do anything with it. And I think the premise of today's show, I'm on your side on this. So I don't have like, I don't have something for sale at the end of this.

Peter Boulden
0:03:15
Right, right.

Jeff Hopeck
0:03:16
I'm on your team.

Peter Boulden
0:03:17
You never bring anyone on this stuff for sale, Jeff.

Jeff Hopeck
0:03:19
Yeah, and I love that, but you've always been like that from the days back in Galveston, Texas, I remember that. So I want the posture to really be felt that I'm not a dentist, but all my businesses are in dentistry, in and around dentistry. I'm really coming to you guys today on your team. This is a problem and I'm going to unpack it. This is a problem that is here already, but this thing's going to get big. And I saw evidence.

Peter Boulden
0:03:46
I mean, here already we saw, and I don't know, look, I'm not trying to be the hacking expert. Like I know you've kind of dug into this from, you know, but look, databases are valuable, like you've just alluded to, especially medical and dental databases. And then if you can kind of hold them hostage, like I think, and I'm just speaking what I've heard, but like that kind of happened to Aspen where they, where their, their whole database got, got taken captive. And then there was a kind of a ransom deal going on. And it was bad because honestly we had doctors in the space being like, I can't get paid because this, and it was just, it was just tragedy. And you know, and we're all familiar with like computer software, right? Like I just had to upgrade ours from, you know, from a HIPAA compliance standpoint, you know, our email records, you have to kind of educate your team. Like don't click on attachments if you're not 1,000,000% competent of the recipient that's sending it or the sender. But honestly, these hackers and these scammers are getting so much more sophisticated, man. It's I actually fell for one the other day. Luckily, I caught it, but it was it was a Google one and they had just taken they had taken everything. And everything looked the exact same, the Google address looked the exact same, because I always check the like this, who's it from button, right? And if it's like this long string of stuff, it's worth like Google's misspelled, you know, kind of thing. And you know, like, okay, this is shady, but they're getting more and more sophisticated. So that's the last, I'll talk about this, because I'm not the expert, but I do know that we are more than vulnerable to this than a hair salon, let's just say, right? Or a car dealership or something like that. We have more valuable information. And when you have more valuable, when your business is predicated on running from that information, then obviously someone will come after it with more fortitude because they know like you'll pay more to get it back almost. Like if that's what happened, if it's held ransom. But you may not be talking about that today.

Jeff Hopeck
0:05:38
So break down the difference between hacking, Jeff, and like human hacking, what you're talking about. Yeah, for sure. Great, great question. So hacking we all know. And if I asked you, you'd answer the question and get it, you'd hit it 90 percent. It's I clicked on something and then now a company has our QuickBooks login, okay, or they have access to my mainframe or patient records, whatever it is. But it's done, it can be done electronically and it can be done with a person sitting in, pick a country, and they can hack a little tiny dental practice here or a cluster of practices or DSO or whatever, hospital. Human hacking, which is what the point of our show is today, human hacking is when a human being is manipulated. And the reason, one of the reasons, they're saying this is going to represent 80% of all hacks in just two years, within the next two years. The reason, the reason this is… To businesses, maybe? Yeah, to businesses. So, right now, if there's a few numbers out there, right? So, 700,000 hacks per year on small businesses. Healthcare just made the list number four.

Peter Boulden
0:06:53
What is the motive though for hacking other than causing chaos? Is it for financial gain somehow?

Jeff Hopeck
0:06:59
Well, let me tell you a story.

Peter Boulden
0:07:01
All right.

Jeff Hopeck
0:07:02
I'll tell you exactly how this is gonna play out in dentistry. This is how it's gonna play out. I'm gonna make up the person, me, as the hacker, and I'm gonna make up the dental practice as you, Atlanta Dental Spa. Okay, Jeff decides, I'm not a dentist, but I wanna get into dentistry, and what I wanna do is buy 20 offices, but the best guy in town's Atlanta Dental Spa, so I wanna model what they're doing. I can walk in, I can look around. There's only so much I can get. Hacking, the old hacking that we talked about, more expensive, harder, and there's no guarantee. Somebody can try to hack into you, wait for months and months and months and never get in.

Peter Boulden
0:07:45
So when I think of hacking, I'm going to break it down because I'm sure some people are confused. So I think of hacking, I think of a guy behind a computer doing stuff. I don't think of like someone, you're saying someone hacking for almost intellectual property, IP, or the way your system goes too.

Jeff Hopeck
0:07:59
Yeah, well here, as I go through the story, you'll see it. So now, here's Jeff, and I have, let's make it up. I have deep pockets, I want to open some dental practices in and around Georgia, but I need to know why is Peter's practice so unbelievably successful? So here's what I would do as a hacker, okay? Please, everybody's got to, I'm on the good side of this. I'm not on the bad side. So in this scenario that I'm making up, I'm putting myself in the bad shoes, but here's how I could think like a criminal. I'm gonna go into your practice and sign up as a new patient. So remember what my goal is. I wanna get the keys to the kingdom, which is getting into all your patient records, figure out what's going on, what's your secret sauce. So I go in and I sign up as a new patient, sort of learn about the practice a little bit. Oh, Mary's clearly the person in here that's gonna have, that has the access that I need. So I'm going to really, my focus, yeah, I'm going to be a patient and it's going to look good, but I've really got to get, get into the system through Mary. So here's what I do. I go out after appointment one and I use another tool technique called social hacking. Now here's how one of the many ways that social media accounts are being exploited and used. I'm going to go out to all of Mary's accounts and see what's Mary all about. I wanna see, you know, in her Instagram, I might see one part of her life, Facebook, another part, LinkedIn. But what I'm really looking for, one of two things. You can exploit somebody's weaknesses or you can capitalize on some kind of strength in their life, something good. So what I'm going to look for is not some kind of threatening information to come back to Mary. I just noticed that two years ago on LinkedIn, she supports the local animal shelter and most of her time is clearly given there. So here's what I do. I put together this is how sophisticated it gets. Now this still gives me goosebumps even explaining this for the 500th time now. I go out because I'm a sophisticated human hacker, right, remember in our scenario, I go create a website, a brand, a story for this new startup software that I have. And what it does is it helps shelters, animal shelters, because remember that was Mary's, one of her strong, one of the places she focuses her time. I want to try to help her because I got to get really tight with her because I got to get in to Peter's, I got to get the keys to Peter's kingdom. So here's the way it works. So I sneak in to the practice, stop by the practice, no appointment. I stopped by a couple of weeks after that first appointment I had and I go, Mary, I know I mentioned last time, but I was so busy. You mentioned that you love shelters and stuff like that, but I didn't have time to talk to you about it. I have a business that literally helps shelters. So now as soon as I say that, as soon as I go, helps shelters, that aligns with one of her favorite things on earth, she loves donating her time, giving her time and resources to shelters. So now she's all ears. So I say, here's what, actually have a product that I developed that's gonna help you raise more money to your shelter. I have 10 people that are trying it out right now, it's 100% free. I'm gonna leave you a jump drive.

Jeff Hopeck
0:11:21
Ding, ding, ding.

Jeff Hopeck
0:11:21
To me, I know what that means. To the average person sitting in a practice, great, this is cool, it's something free. Guess what happens? I walk away, thumb drive goes in the computer, in 30 seconds, everything, every single aspect of your practice, I now have. And you know what that thumb drive does when it goes in your computer? Turns the screen black and the user, the person who inserted it in, is just thinking, oh, it must not be compatible. 30 seconds goes by, game's over. I have everything about every aspect of your life, personal, professional, because of that episode where the jump drive went in the computer. Those stories exist because human hackers right now are using that level of human interaction, human manipulation to now remember the difference you asked me, Peter, what's the difference between regular hacking and human hacking? I still hacked. I got everything, but I got it in a completely different way.

Peter Boulden
0:12:17
I passed all the firewalls, the Norton antivirus, all the things. You went directly to the human and manipulated them.

Jeff Hopeck
0:12:24
There are stories, Peter, if we had five hours on this podcast, I could fill you with 50 stories in a row of unbelievable, true life, real scenarios that have happened or are in progress of happening that are all really cool like that. Like you get in with the cleaning crews, okay, you know, just fascinating. List goes on and on and on. Yeah, there's some great stuff out there. That's one of the best ways in office parks and stuff like that is like through the maintenance crew.

Peter Boulden
0:12:51
But is it, is it to, is it to potentially obvious potentially just to, Hey, I want to copy the business. I want the IP, I guess it could be a lot of different motives or I want to take over the whole network or their system and then hold them hostage. Like I kind of alluded to the beginning. Yeah. Great question. All those things, or is it, is it mainly the examples you're hearing about? Um, what, what is, what is the, what is the, what is the motive?

Jeff Hopeck
0:13:15
Yes, so there's multiple, right? And you really did hit on some of the main ones. Again, in this scenario I gave, I'm protecting my investment, because remember, I'm the guy with deep pockets that wants to drop 20 locations in and around Atlanta and do it better than Peter. So first, I need to know how Peter's doing it, because he's clearly got a secret sauce. Well, once I go in, it's game over.

Peter Boulden
0:13:39
Would they be seeking on that computer, on Mary's computer, is all the IP and workshops and documents and all the things or is it just the patient database that someone would seek or is it all the above?

Jeff Hopeck
0:13:50
It is everything. I mean, it's going to be everything. Think of what ties into your entire dental practice, everything. So all QuickBooks, QuickBooks is going to be a big one that they're going to want to

Peter Boulden
0:14:00
ask you. Would people know that like that guy who handed Mary the thing is now the culprit? The reason, right, the reason that hacks happened behind, you know, keyboard warriors and a dark cellar is because no one, you know, they're anonymous. So wouldn't you know, like, why would someone actually be like, hey, Jeff's coming into the office. I've seen his face. He's on our security cameras. He's the one who handed us this jump drive and now the computer's smoked. Like you know what I'm saying?

Jeff Hopeck
0:14:22
No nothing will be smoked. No the nothing at all would be smoked because once she takes that jump drive out, remember all Mary's thinking is like, okay, I'm going to have to get back to him. This must be broken. This doesn't work the right way. He might've given me the wrong one. You will never know. Like literally never know anything touched your system at all. And then like, as soon as the jump drive comes out, it's business as usual. You're not going to get an alert. And this stuff's so sophisticated. This is getting around. So I want to tiptoe here. Most IT groups, this is what happens if you ask a dentist, hey, what's your cybersecurity protocol? This is the answer. My IT has that handled. IT is not cybersecurity. IT groups may know cybersecurity. They may know tips, tricks, lingos, hacks, et cetera. It's a separate skillset. You need to have a cybersecurity protocol. I actually read something recently. I'll try to pull it up here while we're sitting on, while we're talking. For HIPAA, so you know how you have to get the HIPAA certificate every year. Now there's a cybersecurity, but it's at the federal, it's at the government level right now. They're trying to pass another HIPAA where you have to have a cyber. Nothing to do with IT. It's straight cybersecurity certification every year to be handling this.

Peter Boulden
0:15:40
So from a compliance standpoint?

Jeff Hopeck
0:15:42
Yeah, all compliance.

Peter Boulden
0:15:43
Yeah.

Peter Boulden
0:15:44
So, yeah, you're right. I think most people would say, yeah, like I'm assuming my IT guy, he manages my servers and hooks up our printer and all that stuff. I'm sure he's got us secure, right? You know, my team knows, or maybe they don't know, don't click on non vetted attachments. Because I guess that's that's kind of a wormhole as well. Right. Now, I've actually had evidence in my my career where, you know, that has caused a widespread virus. You know, again, I didn't know what the point of the virus was. It was just to cause chaos. It didn't you know, who knows what it did. But like we stopped it and all that stuff. But it was from someone in just that one computer in our land, our local area network, clicking on it. And then it spread, obviously, like a virus. This is perplexing and I have a hard time wrapping my head around it, mainly because I'm wondering, like, this is a lot of work, right? It's a lot, like, you're saying setting up a business and a fictitious account and a fictitious email and blah, blah, blah, going in as a patient. Like, are people really getting that desperate? You know, like, because, and are they doing this? Because honestly, Jeff, because, because softwares have gotten more sophisticated, the firewalls, the Google kind of, you know, Google mails running things and being more, you know, scanning on the front end for you just, just to prevent it, because things have gotten better on the, on the firewall standpoint. Or is it just another, is it just another means of like, well, it's not gotten better, it's not gotten worse, but here's just another thing now you got to work out for. Now you can look for.

Jeff Hopeck
0:17:17
It's a couple of things. So it's different breadcrumbs that are going to get left behind. So if somebody does try to hack your firewall and you're, if your IT is running parallel with a great cybersecurity firm, you're going to get notifications that somebody is trying to get in what country they're from, who they are, et cetera, but if I'm going human, the human route, if I'm going the human route, I'm not leaving that kind of bread

Peter Boulden
0:17:40
crumb out on your computers. So what's the nuts of it? Obviously you're passionate about this, you want to protect people in your space, your friends, your family, the dental industry. Like what's the takeaway, right? Where does the rubber meet the road? What's your advice? Because no one's gonna dig in like you have. Right. What do you recommend with practical advice, right? Like don't get too extreme. You need to have things locked in a lockbox and no one can have access and there's 12 points of two-factor authentication right like where's there's got to be some things potentially someone hearing this Jeff it could have saved them you know hundreds of thousands of dollars or millions of dollars or tons of stress in their life just by you know if it helps one person then it's freaking worth it so give me some takeaways because I'm speaking yep what are the nuts of it okay it's just

Jeff Hopeck
0:18:22
my favorite part so I'm gonna I'm gonna give you a handful Peter and before I do, let me give you just a wowing piece of information to give you an example of how big the internet is. So if I go to you, how big is the internet? Maybe our minds would go like, hey, I typed in dentist and it gave me like, you know how to tell you like 4 billion pages of results. So then maybe you can go, all right, well, how many words are in the English dictionary? And if everyone had an average of 1 billion pages resulted, it's hard to get our arms around this. Well, let me give you a number. So that you, me, your team, my team, the internet we know and use every single day only represents, get ready for this, 5% of the size of the internet. The publicly accessible internet is only 5%. 95% so 5 times Watt equals 95. 95% is the dark web where all this stuff is at. Now if you want to see, wait till you see this. Wait, just get ready. Every single day because of my hack, because remember my hack in 2015. I am now on this, you know those companies that are like monitor your credit and monitor your identity and stuff like that. Life Lock, there's a lot of them. I'm on a very advanced one of those where every one of my credit cards, debit cards, bank accounts, addresses, social security, my kids, social security, my wife. Personal protection, you're saying,

Peter Boulden
0:19:55
just as a personal, okay.

Jeff Hopeck
0:19:57
Of everything, and it's very sophisticated. I will get alerts daily that my information's being used on the dark web, but then the best part is to get the actual nuts and bolts as to where it's getting used. So one thing you can do right now, you can use a dark web monitoring tool. You can do ones that you pay for. I'm gonna just read, I have one pulled up right here because it literally is always a tab on my computer. I use like one.google.com.

Peter Boulden
0:20:26
One.google.com?

Jeff Hopeck
0:20:28
Yeah.

Peter Boulden
0:20:29
So Google has a service?

Jeff Hopeck
0:20:30
Yeah, and I'll just give you an idea. So, you want it broken down into little tiny nuggets. This is chilling stuff. So, every day, I get 20 notifications. Oh shit. Here's a group called Explore Talent, okay? And you can start to research these people and see what's going on. I always talk in my marketing business about scrape websites that scrape. Here's two now since I've been using Google one. I just got scraped, scraped yellow pages business and scraped LinkedIn profiles. These are companies that are, they're fraud, they're dark web. They're trying to go out and scrape legitimate sites, pull the information back, and then we can get into what they're using it for. I love it. I love the motive behind it, just shining a light to it. But here's some other stuff like California.bizhighway.com looks like a completely legitimate website. It's on the dark web. And it tells me they just emailed back and forth within their mainframe, my email address and my password. What? Dude, thousands, thousands. Now I probably have maybe a little bit more internet exposure so the average person's probably not going to get as many notifications I do because of the websites and the businesses and stuff.

Peter Boulden
0:21:49
I just did your one.google.com that quickly while we were talking. I had 61, I put in information that was imported from already Google has and it

Jeff Hopeck
0:21:58
was like I just gave it permission. 61 data breaches. Data, here, we can go back and forth on this. Canva, Canva got hacked, Canva got hacked, and my email username and name have been exposed. Evite, MGM, so once those companies get hacked, everybody who has profiles under them, all their stuff gets exposed, so it's endless. But, how about this one? So I told you, I'm under this really sophisticated, which would be way next level than Google One, real sophisticated monitoring program. I will get an alert that goes something like this, a child predator just moved 1.7 miles from your house. Just bought a house. So it's everything, like literally everything in life. This is much more than just dental, the stuff that we're now, but you, you are hacked. It's like, you have to assume that you are already hacked. A hack isn't like, Hey, they got in now my whole computer's crashed. No, they get in, they have a constant pipeline. So every time you enter a key into your computer, it's going right to their, like it's going right to them. So they, once they leech on it's guaranteed, like they're just going to keep sucking out data. So, okay. One nugget, use one Google. That's a great start. This will start opening your eyes. Then, um, another one. I love it. A lot of my friends are in it. I t is not cyber security. Okay. If you're out there and you're in it and you know, cyber security, great, happy. That's like knowing Spanish and Mandarin. So happy for you. Most are not though. And the dentist said the same thing over and over and over again. Doc, what's your cybersecurity protocol? Boom, I can guarantee it. Oh, my IT group has it handled as they have the login for your GMB, as they have the login for your GoDaddy. Like, oh, you need protocol. So let's dive into, so that's two nuggets for you guys. is take the next step. Your initiative, don't task IT to do it, don't task anybody in your building. Take the next step to seek out a cybersecurity group to come in and audit what you're doing. And a cyber group can plug into your system and tell you if you are currently under attack. That sounds expensive. No, it's not just do an audit a great audits gonna cost you 1,500 get a baseline get a baseline it you need to know where you're at because This is what's happening right now is it's just like when HIPAA the whole HIPAA thing exploded and came out and then you had a practice that could find 500,000 for it and HIPAA sort of everybody formulated their opinion. I'm only gonna go so far in protecting us. Okay my practice I'm only gonna spend so much. I think this is different. I think this is different. This is a new battle that's being fought. Forget healthcare. Certainly forget dentistry. This is being fought amongst countries right now. Okay, this is how countries are getting intel from each other. This is so incredibly massive. And what do we know about dentistry? We get five years. We're five years behind small business. So just follow the breadcrumbs here. We all, we got the dates are on the internet. Like when did OPM start? When did this start? When was this hack? Dentistry, we already know the big one, the big Aspen. This is going to continue. And the evidence is because the brand new updated list of small businesses that are getting hacked, healthcare just jumped up to number four. We used to not see healthcare.

Peter Boulden
0:25:40
Yeah, I was right, Jeff, about, you know, I was watching my words because I didn't have evidence that it was a hacking thing from the Aspen. I didn't have concrete evidence, but I'm pulling up this article here where it says, late April 2023, Aspen General announced it was the victim of a cyber attack that shut down its deployment, scheduling systems, phone systems, and other business applications. It's still clear, it's still unclear if they were unable to access patient files, but Aspen has more than 1,000 locations. And so it probably gives you their motive of why they did it. Obviously, they probably had to pay to get that person out of there. Then this goes on to talk about HIPAA compliance and things like that. So I guess, Jeff, what I'm trying to say is without this data point of like, hey, it's happened to someone in our industry, then I'd be like, I don't know if dentistry, you know, I don't know if this is really going to affect dentistry, but it's there. It happened this year. Right. And some and that's going to be someone if that was a successful mission of a cyber attack, right? There's going to be a lot of of of imposter's followers say, hey, they did it with Aspen. I'm in Aspen's probably sophisticated. Let's go after these little guys. Let's go after the mom and pop, because they're going to be equally as protective or incentive to keep their, you know, we're going to be able to ransom them as well, so to speak. All right. So basically, step one was you said, hey, look at, yes, the practice is an issue. Yes, your employees are potential of human hacking. But first step is probably protect yourself from identity theft, your kids, you know, the dark, uninsured yourself on the dark web. I actually had that. I had, I was a victim of identity theft and anyone who's gone through that. You only have to go through it once. You have to realize like, Oh my God, I could have presented this. And, oh my gosh, this is giving me brain damage. The amount of things that I have to go do now in perpetuity, just to protect myself because like, you know, and it still causes problems to this day with credit and things like that, you know? Um, and I, you know, and one simple thing that doesn't cause anything is that courage, everyone to put it, you know, all the credit bureaus will put a free, you put do a complimentary freeze on your account. Right. So you log into all three bureaus and you just freeze your credit. So granted, it's a pain in the ass when I have a lender coming to me and says, hey, open it back up, you know, for a short period of time. And I'm like, oh, God, what a pain in the butt. But but it is a little. But I had to do that because of my my identity hack, right? And now I have a special pin when I file my tax. Like someone actually went through and filed taxes as me, all the things, I have a special pin from the IRS. But I could have been, what I'm trying to say with this is I, had I been more diligent before it happened and just kind of get a little bit of things here and there, I wouldn't have fallen prey. And so, so first step, I'm rambling a little bit. So basically your first step is protect you, protect your house, protect your family kind of thing. And then two, it's looking and then maybe have a cyber audit done on your business. Having someone come in to say, hey, here's your vulnerabilities. You look good, you don't look good kind of thing, right?

Jeff Hopeck
0:28:44
I think it's critical, yeah. Just do a baseline. Don't buy a contract, right? Don't sign up for something that locks you in for a year. It's a one time, give me an audit and a baseline. Then maybe what can happen with the audit and a baseline, maybe that's a bulletproof conversation where we do another one of these after 50 people submit, Hey, this is my baseline. What do I do? Maybe we can, maybe we can take a look at them.

Peter Boulden
0:29:07
Do you, do you feel it's issue still with maybe the answer? You know, I'm thinking, wow, just one more reason to go into the cloud with software, right? Because then the data becomes their responsibility, right? Or, you know, versus like local servers, like we still operate our patient management software on local servers. In my office, I use Eaglesoft, right? And so I'm still managing it, which I'm wanting to go to the cloud, right? And this is one of the reasons is that I don't have to have the complex I.T., complex cybersecurity, I don't have to have servers in my offices, those kind of things. Is this going to be as big an issue with cloud?

Jeff Hopeck
0:29:42
You know, let's make sure we, so from the human hacking, it would be irrelevant because remember I'm, and I want to stay focused there from the human hacking, it wouldn't matter because you're, you're cleaning people. I mean, if somebody comes around and makes friends with them and offers them 10 grand to make a copy of all your files, to do anything, fill in the blank. You're gonna get it. You're gonna get it. And that's the thing that I'm most concerned about here is that human element. So as you start a cyber baseline, you can then know from there where you gotta, where and what to at least begin tightening up. Because this is new for everybody. I think this is gonna be new for a lot of your people. Just half of them might say, this is insane, I'm not investing anything here. And then you're gonna have the other half or 30% that sort of like that, they like that whole, you know, espionage type of, you know, they're watching those kind of documentaries and they like those kind of things.

Jeff Hopeck
0:30:41
And-

Peter Boulden
0:30:42
Well, I get accused, Jeff, of wearing the tin hat a lot on this podcast when the other four of us are listening, right? I'm like the more of the conspiracy theorist and I think like, oh my gosh, the sky is falling, protect this, protect that. And so, you know, someone may look at you and say, hey, you're only like this, you know, you're only saying this potentially because you've studied the 500 cases where you've seen it happening. So when it's all around you, right, you know, you're thinking like, oh my gosh, this is so prevalent versus the person listening may be like, yeah, yeah, not an issue. Like you

Jeff Hopeck
0:31:10
said, I don't think they don't think so. Oh, it could take 15 minutes and go on right now and take the fear to the next level. It's not what it's about, but it's real. This is real. Now, again, if you gave me a minute after and go, okay, Jeff, now what's the pitch? All right, everybody sign up for this. You don't have a security company. I'm on your team. I want to help. This is coming down the pipeline. It's here. Yeah. Did you also mention that there were people who are, you know, obviously trying to poach?

Peter Boulden
0:31:34
I mean, is another form of human hacking people like saying, hey, I know an easy way to get the IP. Let's just poach that that employee that's been there for 20 years kind of thing. And then they will bring over all the information kind of thing. Yeah. Another form. I could have sworn we talked about that in prep for this call. Yeah. That's something to be worried. And look, you cannot insulate against that. Right. Like, I mean, that's just shitty people doing shitty things.

Jeff Hopeck
0:32:04
Yeah. I think another thing that happens, Peter, you could probably even put this for your like, the nuggets that you said. I think another safe nugget is to have a heart to heart with yourself. Exclude your office manager, just you and a window or a mirror and just go, Do all my team members need to see what they're seeing? Cause I could tell you from being in the, you know, listening to phone calls with Shark Talk or our marketing, Killer Shark Marketing, we will see that as a giant gaping hole such as this. We just had a huge meeting the other day, very large group in Florida. We made our first presentation of what we're hearing on their phones. So there's going to be a lot of sensitive talk and sensitive information. And you just got to say, do I have the right people in the room? Does everybody need to know this? Like we have another group that they've been with us forever. We love them and it's just their management style. But I strongly would disagree with this. Every meeting, everybody is there for it because they do it on their lunch break. It's like, no, we have to talk about money sometimes, and we got to talk about, we heard this on a phone call, or that on a phone call. So I think have that heart to heart with yourself.

Peter Boulden
0:33:26
Well, okay, I'm going to push back, because I am obviously, because we, Craig and I really are fans of transparency in the business, right? And so I see these evidence, these doctors being like, you asked, like, for instance, my sister-in-law's hygienist in Mississippi and she doesn't know she I asked her I was like so what's the practice do she's like I have no idea I was like you don't know your daily collection she's like no idea she's like they share nothing with us and she was she had some venom in that basically like you know not involved in the team because I don't know anything like I'm just there to like scrape teeth and go home yeah I was like you know and so obviously bonuses are a big part of dentistry and doing well. The business does well, then the team does well. But how can you do that if you don't have transparency on your numbers? Oops, excuse me. On your numbers, right? And so I am a fan of sharing, but does everyone need to have access to P&Ls? No, right? Does everyone need to have access to any kind of LLC formations, partnership agreements, things like that. No, but typically in the patient management software, unless they've been blocked out of that access, they can, you know, if they're sophisticated, they can go in and see like, here's the, here's the collections, here's the production, here's the accounts receivable, here's all this stuff, right? So like I said, shitty people can do shitty things if they want. And there's no way you can really insulate and firewall yourself from a, from a inside the organization without you just becoming just ultra paranoid, right? And then almost doing your life.

Jeff Hopeck
0:34:53
Right, right.

Peter Boulden
0:34:54
So yeah, that's what we're for healthy balance, right? And so, you know, I'm gonna disagree because I do like, I like teams to know things and be aware, you know, but most dentists get uncomfortable with that. Like, I don't want them knowing what the practice makes. I don't want them knowing what I make. I don't know what I'm knowing these things. And so that's fine. That's their prerogative. They're a business owner. That's the way they want to do. But I hear you on the looking yourself in the mirror, but for me, I don't know if I want to change that, even given what you said.

Jeff Hopeck
0:35:22
Yeah, please.

Peter Boulden
0:35:23
That being said, I'm going to make my team aware, hey, if some rando gives you a USB, like I know it's freaking obvious, but do not put it in your computer, right? Do not click on weird, do not click on any attachment,

Peter Boulden
0:35:37
period.

Jeff Hopeck
0:35:38
Right.

Peter Boulden
0:35:39
You know, and I think that, I think that will help mitigate some things like that.

Peter Boulden
0:35:41
So.

Peter Boulden
0:35:42
It's scary, man.

Peter Boulden
0:35:43
It's scary. Really is. It's frustrating when you, when you see this stuff and you're like, God dang it. You know, I say this all the time in Bulletproof Jeff, like dentistry is hard enough, right? And it's hard enough. You know, we got to, we got to do the dentistry. We got to lead the team. We got to take the risk in the building and buy the equipment and learn this procedure and blah, blah, blah. And now we got, and guess what?

Jeff Hopeck
0:36:03
Let's bolt on one more thing. All right.

Peter Boulden
0:36:05
Let's bolt on cyber security as if we didn't have enough shit to deal with already, right? I know. And my God, so it just, you know, I hate like to bring happiness and not doom and gloom into the world, you know, but like, but honestly, if this brings awareness to someone, it's like, hey, maybe I need to check my six, you know? And you're a guy who's obviously his life kind of, his career kind of started in security, right? From the most important person on the planet.

Jeff Hopeck
0:36:29
Yeah.

Peter Boulden
0:36:30
You know, right? So you are a little more in tune to kind of watching and protecting. Yeah. And so I really appreciate you bringing awareness to the community. And I think it was obviously really relevant again, because we're going to bring up that Aspen hit. So anything else to add in final and closing? I don't want to, yeah, anything else to add to this?

Jeff Hopeck
0:36:52
Yeah, I think, so just let's look out to the world right now outside of dentistry. And if you just do simple searches, you get access to these articles. What is keeping CEOs up at night? Big CEOs, I'm talking about Ed Bastian from Delta to Elon Musk to everybody. And look at the list, but look at what is number one on that list. And you're going to find them on entrepreneur.com and every other news outlet, cybersecurity. So let's, yeah, it's cybersecurity because now this is insane. 90% of businesses in America have been intruded. 90. It's out there. Just Google it. It's on credible websites. It's not like a little blogger that's writing this stuff. Nine, zero, 90 have been intruded. So again, an intrusion doesn't mean like, oh, they intruded me yesterday. I know about it today. You could be intruded and not know about it.

Jeff Hopeck
0:37:46
Yeah.

Jeff Hopeck
0:37:46
But okay.

Peter Boulden
0:37:46
All right.

Peter Boulden
0:37:47
So I don't want to, what's the consequence meaning like, okay, yeah. So I've had a bunch of data breaches. So someone's got my name and they got my phone number. So now I have to deal with a bunch of spam calls, but like big whoop. Right. Like, is that like, is that your, like, I only worry about it when someone's got social security and they're filing taxes on my behalf. And like, you know, they're opening up credit lines or they're finding out where I live and they try to like, you know, I don't know, but I guess it's like a slippery slope, right? Like if protecting from one, you protect from all.

Jeff Hopeck
0:38:15
Yeah, sure. Oh, yeah. Because there's multiple motivate. There's multiple motivations from it. I mean, I don't think we're going to see the ransom in dentistry. You might start seeing it in hospitals where it's like, Hey, I'll give you this back if you give me this. But I think it's going to be, here's what my fear would be as a dentist, especially your caliber and your brand. I live here. Okay. So for context, I live right around all your, all your offices. You're a thought leader.

Peter Boulden
0:38:40
Okay.

Jeff Hopeck
0:38:41
That shouldn't be a surprise to anybody out there doing something incredible. My fear is that if I'm Peter Bolden, I'm going, okay, somebody is going to figure out how we're doing this, what's going on inside, like what's my marketing spend, what's my cost of acquisition, which I love. You taught me this acronym. I just got to listen to the podcast. I tell them everything anyway. They're going to start bringing it, but as your competitor, now somebody is building a mirror practice. I mean, the list of motivation goes on and on and on, and I think we're going to start seeing new cases. Yeah, but look, information is cheap, right? Like getting that information doesn't make you a competitor. The execution of getting there makes you the competitor and people are not willing to do hard shit typically, right? Which is why I'm like, okay, yeah, learn all that information. But it doesn't make me vulnerable

Peter Boulden
0:39:28
just because you know my cost of acquisition, for example.

Jeff Hopeck
0:39:31
No, not vulnerable. And we can go into so many good scenarios, but one of the things I'd love to know is I'd love to know your ratio of payroll to revenue and how that has changed in seasons throughout the year. Because you got something unique going and if I could figure out, is he doing it with people or is more of the heavy lifting coming from something else?

Jeff Hopeck
0:39:56
What is it?

Jeff Hopeck
0:39:57
I don't know what it is.

Peter Boulden
0:39:58
I've got me a spam call coming in right now, Jeff. I was going to loop them into the podcast and see if we can spoof them. Because whenever it says incoming potential spam, it's 100% spam. Hey, so you asked a question. I have a couple other things.

Jeff Hopeck
0:40:15
So you said, what other stuff would you end on?

Jeff Hopeck
0:40:18
All right, so if your dentists have made it this far in the podcast. If we still have listeners.

Peter Boulden
0:40:30
So three people still listening.

Jeff Hopeck
0:40:32
But they could be an incredible three right now. I wanna give them a little bit extra. All right, give them some pearls. If they made it this far, they understand that they've gotta make a move here, one way or another. They're gonna do a baseline or they're gonna do one of the other nuggets. But there's a probably a good chance that if we looked at their Netflix or their Google searches or their audio books, they're probably looking at, they probably binged Jack Ryan, they probably look at CIA documentaries, they're probably intrigued by the FBI, those kinds of things. Right? So they're like, like, it's cool. Right? They're living somebody else's life through the espionage and the unknown. So let me throw a couple things out here because I know you'll appreciate these. I said in a text message to you, I said, hey, you know a watch can tell a lot about you, right? Yeah. So let me ask you, anything come to mind? Obviously you can be in an income bracket, but those days are gone because you don't have to be a millionaire to wear an iWatch. What's something I can learn about you? Just from your watch, I don't have to say a word to you, just by your watch I can learn if you're righty or lefty. Now is it bulletproof, no pun intended, no. Right. Okay, it's cooler. So what happens here with that mind that if you're into that kind of stuff, start looking, wow, how do you put a person together? So you want to start telling their dominant side. Okay. So if my, if I'm like this, what does that tell you? Probably on my phone on what ear? Okay. So it's my dominant side. If you're a left-hander, you're not going to be on your phone this way. Right. Just these little cool things like that. But that was what I was getting at with the wall. So little tells right. No different than like poker right-handed.

Peter Boulden
0:42:20
And malicious people use that potentially as a data aggregation of stuff.

Jeff Hopeck
0:42:27
That's right.

Jeff Hopeck
0:42:28
They start putting a profile together of you. But again, this is, we're talking about just the mind being open. Like just if you're here right now, you're probably interested in this stuff. Here's a couple other cool ones I wrote was when you go into, whether it's coffee shop, restaurant, whatever. One of the things I would strongly recommend doing in the case, in the event of a fire, right? So think of a fire, you're sitting in Starbucks, fire breaks out, do fires happen?

Peter Boulden
0:42:53
Yeah.

Jeff Hopeck
0:42:54
Absolutely, do they happen every, no. Just one of those things, if you have that spy mentality type thing. Know how many steps to the door, because you might have to go find a doorway in smoke. It's just one of those cool little things, right? Yeah, there's no way you've walked into a Starbucks

Peter Boulden
0:43:10
and you're like, all right, cool. I sat down at my chair, I took 23 steps out of here. Right? I will. All of a sudden is bombed.

Jeff Hopeck
0:43:18
I know which way to go and how many steps. Next podcast, we do it out of Starbucks and I'll show you exactly what I do when I sit down. Now, is it a hundred percent sure? No, but if we-

Peter Boulden
0:43:28
I promise you we'll do that podcast, yeah.

Jeff Hopeck
0:43:30
Know a direction, like, you know, know a direction. What room or what floor in a hotel is gonna be the safest? Now this is going back statistics last 35 years. There's an awesome study on this. Up floor. Now, it's actually floor number four. Why? Least amount of casualties. There's all kind of science behind it. They just take all the disasters that happen in a hotel and it's the easiest way to, the easiest escape is from the fourth floor. So when you add in fires and malfunctioning elevators and all those things, the fourth floor has been for the last three and a half decades, the safest place where the least amount of casualties happen. Just cool little stuff like that.

Peter Boulden
0:44:06
Right. Just a little cool data. Data leaves clues, right? So, okay. All right, I'll take that.

Jeff Hopeck
0:44:11
I'm gonna end on one more for you, buddy. All right. All right. So, you're in an area where break-ins are starting to happen, because now they're happening in great neighborhoods too, right? Here and all over. They're all over the place. And are they coming in and taking your most coveted assets and wheeling out your safe? No, but is it the small petty stuff, right? So this front security knows somebody inside job, they get in, they're coming in, they're taking a couple hundred dollars in valuables. Properties get cased, right? There's a phrase called case, so case it. You know, one of the best ways to keep somebody out is, my favorite little tricks. Get a dog, you get it better than a dog because a dog, right, so a dog could be somewhere, a dog could not hear something. There's an element, you take a dog bowl, a giant one, biggest bowl you can buy. Oh my God. Okay. Set it on your front doorstep because I could tell you right now, criminals breaking into your house are not Navy SEALs. Navy SEALs would know how to overcome that. They would know what's going on there. The person coming in your house is afraid of a dog.

Peter Boulden
0:45:16
Yeah, yeah, yeah.

Jeff Hopeck
0:45:17
The statistics are out there. Put a giant dog bowl. Especially a bowl that's 24 inches across, right? And write Brutus on it. They're looking for that. They're looking for that. Cujo. Cujo. And a big old, maybe a big old studded collar that's like, you know, like just left there. Like, oh shit. I like that actually. You know, maybe that's the vacation hack. When you go on vacation, get out your giant ass dog bowl, put it down on your front door and you know, you don't have to leave it there all the time, but

Peter Boulden
0:45:43
maybe that's a deterrent. Yeah.

Jeff Hopeck
0:45:45
Hey, hilarious.

Peter Boulden
0:45:46
Okay.

Jeff Hopeck
0:45:46
So we could even splice this in. I don't know where we are in time, Peter, but here's an actual story that happened in our neighborhood. So not, not dental, but here's a human hacking story. So the bus driver, so we're in a gated neighborhood, 900 homes. Bus driver comes in through the gate, business as usual, drops her kids off, year over year over year, and all of a sudden break-ins started going through the roof. And I'm talking we had like seven break-ins in a quarter. Very unheard of for our neighborhood. Listen to what happened. This is human hacking. The bus driver had the husband on the bus, okay, on the bus Started asking the kids. Hey, who's going away this weekend started to hear when they were going to Disney I'm going here or going there. This is human hacking This is human hacking and started breaking into homes because little Johnny seven years old is going. Oh, we're going to Disney. We're leaving tomorrow

Peter Boulden
0:46:41
Major break-ins to they were big. Oh my gosh, that is crazy. Yeah, you know, it's funny I always tell my wife like do not you know, I'm not a big Instagram poster, but I was like, please, when we're out of town, please do not broadcast to your 50,000 followers that we are not home. Like, can you wait until we get home and then you can post the vacation photos, right? Like that, that always makes me nervous when we're gone and she posts, like here we are in Disneyland or whatever. I'm like, can you not tell everyone we're not home, please?

Peter Boulden
0:47:09
Wait till you come home.

Jeff Hopeck
0:47:10
I got listed on a site one time. It's called pleaserobme.com. It's since been taken down. But I had only, because of my settings, I didn't post it, I was somewhere. My settings triggered. I was away from my house. So this group, they take your information, they post it up on their feed and say, hey, it's so intrusive, because they used my name. Jeff Hopek is not at his house. And it's, I mean, it's insane. That was a famous site for a while. That a dark web site? That's a dark web, yeah, that's a dark web site.

Peter Boulden
0:47:46
All right, well, you've given me enough, you've given me enough paranoia today, you know, now I started my day happy, ignorance is bliss, and now you've made me tin hat again, Jeff. So, I'm kidding, I'm kidding. But you've given, no, it's for real. You've given a lot of indications, not only from a personal perspective, business perspective, we've talked about some stories and I think, look, I always say this to everyone, even in summits and on the podcast and mastermind is that sometimes you don't, sometimes there's no takeaway from what you're hearing. Maybe you don't take it away from the time in which you're hearing, but you can't unhear what you just heard. And so it creates that micro awareness, that little awareness of like, you know what, like maybe that little thing, right? And so, so awareness is just the key, right? And so many of us don't, wouldn't even know this is an issue, right? Without you talking about human hacking, or the Aspen event, or the, you know, what you just talked about, the please rob me. But awareness can sometimes help someone protect themselves a little bit, and be like, huh, you know, I remember Jeff talking about like this dog bowl, like, you know, who knows?

Peter Boulden
0:48:48
Yeah, yeah.

Peter Boulden
0:48:49
So, I love it. I love just bringing awareness of things. And I say this stuff in marketing, right? Like when I have a marketing lecture, I'm like, look, you're not gonna learn the 20 years that it took me to learn this stuff in two hour lecture. I'm just sorry, you're not. But you may get a pearl or two, or you may get awareness for the next time that you hear something that's applicable to you, right? And so, anyway, I just wanna thank you for your time. I wanna thank you for kind of like caring enough about dentistry to dig into this and help people protect themselves, even if it's a little micro level, right? Maybe it's not the extreme like you're going through on your dark web stuff, but creating awareness.

Jeff Hopeck
0:49:26
Hey, Pete, listen, if it doesn't feel right, this is the mindset I would love all your clients to get into. If it doesn't feel right, it's not. Stop fighting it. Like if something's not happening right in your office, if somebody has to turn a screen when you come around, or if it doesn't feel right, it's not right, and act on it, don't wait to be the person who 10 years from now goes, gosh, this person gave all these little clues, they wouldn't let me see the computer, they would flip it around, and now you waited 10 years.

Peter Boulden
0:49:56
Yep, and then you find out, like me, you were embezzled from, so that was awesome.

Peter Boulden
0:50:00
So, just kidding.

Peter Boulden
0:50:01
Buddy, kidding, not kidding.

Peter Boulden
0:50:03
Yeah, all right.

Peter Boulden
0:50:04
Anyway, buddy, always good to connect. And yeah, and so how, if someone wants to just become a fan of Jeff Hope, how do they do so?

Jeff Hopeck
0:50:12
Yeah, probably the easiest thing is, my two businesses are Shark Talk. So that was started in 2015, where we have a human component that goes in and listens to phone calls and shows you how much you're losing on the phone, but takes it to the next level. Now we give insights every month on how to improve that. It's all part of one product. So just go to sharktalk.me, send us an email there, or My Business, which is started in 2007, which is you're the first dentist I ever worked with, and the first podcast I ever did with you. We still get people coming in for Shark Talk, which is remarkable. Killer shark marketing, just go to our site there, reach out to us. And I want to keep feeding you guys as I hear more of this stuff, like soaking into dentistry. I'll keep feeding you guys nuggets that you can put out to your audience. Yeah, keep us on the bleeding edge. Yeah, I will. I promise.

Peter Boulden
0:51:03
All right, buddy. Good as always to see you, and we'll see you next time, pal.

Jeff Hopeck
0:51:06
Okay, buddy. Thanks a lot, man.

Peter Boulden
0:51:08
See ya. See ya.

Jeff Hopeck
0:51:08
Bye.

Transcribed with Cockatoo