{"id":"dentaquest-patient-data-breach-may-2026","category":"breach","status":"closed","title":"DentaQuest breach exposes dental and vision patients’ identities and health information","tldr":"DentaQuest’s May breach exposed millions of people’s identity, insurance and health details. Affected families should confirm their exposure, take up free Kroll monitoring and consider freezing US credit files.","summary":"Intruders accessed US dental and vision benefits administrator DentaQuest’s network from 17–20 May 2026. Affected information varies by person but includes names, addresses, Social Security numbers, insurance identifiers, diagnoses, treatments and billing details; members, providers and other connected individuals were affected. Published totals differ: Healthcare Dive reported more than 15 million people, citing a federal filing, while Indiana’s official register lists 27.4 million overall. Have I Been Pwned separately identified 2.6 million unique email addresses in published data and attributed the extortion campaign to ShinyHunters; that figure is not the total affected population. DentaQuest says it secured its network, strengthened safeguards and began individual notifications on 17 July, offering two years of free identity monitoring. This is a breach, with no consumer software patch. On 7 October, a federal court appointed interim lawyers in consolidated litigation. As at 3 November, recovery or deletion of the exposed data and any resulting identity fraud are not established by the reviewed sources.","action":"Call DentaQuest’s published breach helpline, (844) 959-7163, to check whether you or a family member were affected and enrol in the free 24-month Kroll monitoring. If affected, consider freezing credit files at Equifax, Experian and TransUnion, and regularly check statements and credit reports for unfamiliar activity.","product":"DentaQuest dental and vision benefits","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["dentaquest","data-breach","healthcare","identity-theft","extortion","us"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Notice of Data Breach","url":"https://www.dentaquest.com/en/notice-of-data-breach","by":"DentaQuest","date":"2026-07-16"},{"kind":"news","title":"DentaQuest breach exposes data of 15M people, a record this year","url":"https://www.healthcaredive.com/news/Dental-benefits-administrator-discloses-breach/827533/","by":"Healthcare Dive","date":"2026-08-11"},{"kind":"research","title":"DentaQuest Data Breach","url":"https://haveibeenpwned.com/breach/dentaquest","by":"Have I Been Pwned","date":"2026-06-03"},{"kind":"advisory","title":"October 2026 year-to-date data breach report","url":"https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-October-Year-to-Date-Report-2026.pdf","by":"Indiana Attorney General","date":""},{"kind":"post","title":"In re: DentaQuest Group, Inc. Data Incident Litigation — memorandum and order","url":"https://www.govinfo.gov/content/pkg/USCOURTS-mad-1_26-cv-12458/pdf/USCOURTS-mad-1_26-cv-12458-0.pdf","by":"US District Court for the District of Massachusetts","date":"2026-10-07"},{"kind":"news","title":"DentaQuest, LLC data breach notices","url":"https://www.acidpeak.com/notices/dentaquest-llc-2026-07-16/","by":"AcidPeak","date":"2026-10-23"}],"started":"2026-05-17","closed":"2026-10-07","created":"2026-11-03T20:14:31.229Z","updated":"2026-11-03T20:14:31.229Z","cve_notes":[],"timeline":[{"at":"2026-10-07","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"A Massachusetts federal judge appointed interim lead lawyers in the consolidated DentaQuest data incident litigation. The order concerns legal representation and does not announce a settlement.","url":"https://www.govinfo.gov/content/pkg/USCOURTS-mad-1_26-cv-12458/pdf/USCOURTS-mad-1_26-cv-12458-0.pdf","by":"US District Court for the District of Massachusetts","patch":null},{"at":"2026-08-11","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Healthcare Dive reported that more than 15 million people were affected, citing a federal breach filing. That figure differs from the 27.4 million total in Indiana’s register.","url":"https://www.healthcaredive.com/news/Dental-benefits-administrator-discloses-breach/827533/","by":"Healthcare Dive","patch":null},{"at":"2026-07-17","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Indiana’s official register records this notification date, 119,600 affected Indiana residents and 27.4 million affected people overall.","url":"https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-October-Year-to-Date-Report-2026.pdf","by":"Indiana Attorney General","patch":null},{"at":"2026-07-16","added":"2026-11-03T20:12:05.486Z","kind":"vendor-revised","text":"DentaQuest updated its notice with the exposed identity, insurance and health information categories. Its data review remained ongoing, and it offered affected individuals two years of free Kroll identity monitoring.","url":"https://www.dentaquest.com/en/notice-of-data-breach","by":"DentaQuest","patch":null},{"at":"2026-06-03","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Have I Been Pwned added data containing 2.6 million unique email addresses. It reported that ShinyHunters had published data allegedly obtained from DentaQuest during an extortion campaign; this email count was not a count of everyone affected.","url":"https://haveibeenpwned.com/breach/dentaquest","by":"Have I Been Pwned","patch":null},{"at":"2026-05-26","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"DentaQuest first published its public incident notice.","url":"https://www.dentaquest.com/en/notice-of-data-breach","by":"DentaQuest","patch":null},{"at":"2026-05-20","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"DentaQuest discovered the intrusion and says the unauthorised access ended by this date. It secured its network, contacted law enforcement and engaged outside investigators.","url":"https://www.dentaquest.com/en/notice-of-data-breach","by":"DentaQuest","patch":null},{"at":"2026-05-17","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Unauthorised access to DentaQuest’s network began, according to its subsequent investigation.","url":"https://www.dentaquest.com/en/notice-of-data-breach","by":"DentaQuest","patch":"na"}],"url":"https://hard.fyi/live/dentaquest-patient-data-breach-may-2026/","json":"https://hard.fyi/api/live?id=dentaquest-patient-data-breach-may-2026"}