That malicious software has since been removed and a forensic analysis of the server has found no signs any information has been obtained or misused.
The practice said the email server contained some personal information, which was potentially exposed for a period of time.
Personal details, including names, dates of birth, phone numbers and addresses, were held on the server, as well as health information, such as dental photos and scans, referrals, information about procedures and insurance claims.
A Symes de Silva spokesperson said as soon as they discovered the problem, the server was taken offline.
It has also carried out further IT checks to ensure its systems are secure.
The Privacy Commissioner has been notified.
- RNZ