DentaQuest breach exposes dental and vision patients’ identities and health information
DentaQuest’s May breach exposed millions of people’s identity, insurance and health details. Affected families should confirm their exposure, take up free Kroll monitoring and consider freezing US credit files.
Call DentaQuest’s published breach helpline, (844) 959-7163, to check whether you or a family member were affected and enrol in the free 24-month Kroll monitoring. If affected, consider freezing credit files at Equifax, Experian and TransUnion, and regularly check statements and credit reports for unfamiliar activity.
What’s happening
Intruders accessed US dental and vision benefits administrator DentaQuest’s network from 17–20 May 2026. Affected information varies by person but includes names, addresses, Social Security numbers, insurance identifiers, diagnoses, treatments and billing details; members, providers and other connected individuals were affected. Published totals differ: Healthcare Dive reported more than 15 million people, citing a federal filing, while Indiana’s official register lists 27.4 million overall. Have I Been Pwned separately identified 2.6 million unique email addresses in published data and attributed the extortion campaign to ShinyHunters; that figure is not the total affected population. DentaQuest says it secured its network, strengthened safeguards and began individual notifications on 17 July, offering two years of free identity monitoring. This is a breach, with no consumer software patch. On 7 October, a federal court appointed interim lawyers in consolidated litigation. As at 3 November, recovery or deletion of the exposed data and any resulting identity fraud are not established by the reviewed sources.
- What
- Breach
- Affects
- DentaQuest dental and vision benefits
- Fixed in
- Nothing to patch
- Since
- 17 May 2026
- Closed
- 7 Oct 2026
Timeline
- Update
A Massachusetts federal judge appointed interim lead lawyers in the consolidated DentaQuest data incident litigation. The order concerns legal representation and does not announce a settlement.
- Update
Healthcare Dive reported that more than 15 million people were affected, citing a federal breach filing. That figure differs from the 27.4 million total in Indiana’s register.
- Update
Indiana’s official register records this notification date, 119,600 affected Indiana residents and 27.4 million affected people overall.
- Vendor revised
DentaQuest updated its notice with the exposed identity, insurance and health information categories. Its data review remained ongoing, and it offered affected individuals two years of free Kroll identity monitoring.
- Update
Have I Been Pwned added data containing 2.6 million unique email addresses. It reported that ShinyHunters had published data allegedly obtained from DentaQuest during an extortion campaign; this email count was not a count of everyone affected.
- Made public
DentaQuest first published its public incident notice.
- Update
DentaQuest discovered the intrusion and says the unauthorised access ended by this date. It secured its network, contacted law enforcement and engaged outside investigators.
- UpdateNothing to patch
Unauthorised access to DentaQuest’s network began, according to its subsequent investigation.
Sources
- Notice of Data BreachDentaQuest · 16 July 2026
- DentaQuest breach exposes data of 15M people, a record this yearHealthcare Dive · 11 Aug 2026
- DentaQuest Data BreachHave I Been Pwned · 3 June 2026
- October 2026 year-to-date data breach reportIndiana Attorney General
- In re: DentaQuest Group, Inc. Data Incident Litigation — memorandum and orderUS District Court for the District of Massachusetts · 7 Oct 2026
- DentaQuest, LLC data breach noticesAcidPeak · 23 Oct 2026