Loading story…
Dentsu, a leading Japanese advertising and public relations firm, confirmed that its U.S.-based subsidiary Merkle experienced a cybersecurity incident resulting in the exposure of sensitive staff and client data. The breach prompted the company to take certain systems offline as a precaution and initiate incident response protocols, including engaging third-party cyber experts and notifying law enforcement. Dentsu stated that the incident did not impact its network systems in Japan and that the financial impact remains undetermined at this time.
The investigation revealed that files containing information related to clients, suppliers, and both current and former employees were accessed and stolen. Exposed data reportedly includes bank and payroll details, salary information, National Insurance numbers, and personal contact details. Impacted individuals are being notified, and Dentsu has reported the incident to relevant authorities in affected countries as required by law. Merkle, which operates globally and serves high-profile clients, is working to restore normal operations and assess the full scope of the breach.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting said Dentsu warned staff following the Merkle data breach and provided additional detail on the impact to employees and clients. These reports expanded public understanding of the breach's scope but did not indicate a separate incident.
Dentsu published an official cyber incident statement acknowledging the breach affecting Merkle and related international operations. The company said it was investigating the incident and taking response measures.
Dentsu disclosed that its U.S. subsidiary Merkle experienced a cyber incident that resulted in unauthorized access to data. Reports said the exposed information included employee data and some client-related information.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcego.theregister.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcegroup.dentsu.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DentaQuest, a major U.S. dental benefits administrator owned by Sun Life, disclosed a cybersecurity incident involving unauthorized access to a limited portion of its network, exposing sensitive information tied to **2.6 million accounts**. The breach was first publicized by the extortion group **ShinyHunters**, which claimed to have stolen more than **234 GB** of data and later leaked the dataset after an alleged failure to reach an agreement with the company. Analysis of the leaked data found records containing email addresses, full names, phone numbers, dates of birth, genders, government-issued IDs, and health insurance information. DentaQuest said its systems remained operational and customer service saw only limited disruption while external experts investigated the scope of the compromise, but the exposed data significantly increases the risk of phishing, social engineering, identity theft, and related fraud targeting affected individuals.
Jun 29, 2026
DentaQuest disclosed a breach after unauthorized actors accessed its network between May 17 and May 20, exposing personal and dental health information tied to more than 23 million individuals. The company said the compromised data may include names, addresses, Social Security numbers, member IDs, Medicaid and Medicare numbers, provider names, diagnoses, treatment details, and billing information; some reporting said vision-related health data may also be involved. Public filings indicate at least 4.5 million notification letters are being sent, while DentaQuest has confirmed that at least 15 million people were affected and broader estimates place the total potential impact above 23.4 million. The **ShinyHunters** extortion group claimed responsibility, alleging it stole about **234 GB** of data and later posted the material on its dark web leak site after ransom talks failed. Reporting on the leaked files found roughly **2.6 million unique email addresses** and a folder that appeared to contain more than **1.7 million Social Security numbers**, many believed to belong to children in Texas. DentaQuest said it secured its systems, notified law enforcement, hired outside cybersecurity experts and **Kroll** to assess the incident, and is offering affected individuals **24 months** of credit monitoring, fraud consultation, and identity theft restoration services.
Jul 27, 2026
DentaQuest disclosed a security incident that exposed sensitive personal and health-related information belonging to nearly 4 million individuals after attackers gained unauthorized access to its internal network. The company said it detected the intrusion on May 20 and later determined the threat actors had been inside since May 17, during which time confidential data was stolen. A filing cited by regulators in Texas put the affected population at up to **3,973,000** people. The compromised data reportedly included names, personal identifiers, and dental or vision information such as provider names, diagnoses, treatments, and billing details. DentaQuest is offering affected individuals two years of identity protection and credit monitoring through **Kroll**. The incident follows claims by **ShinyHunters** that it had breached DentaQuest and obtained more than **2.6 million** unique email addresses along with names, addresses, and phone numbers.
Aug 13, 2026