Loading story…
New York regulators fined Delta Dental $2.25 million after finding the insurer violated state cybersecurity rules in its handling of the 2023 MOVEit Transfer breach. Attackers linked to the Clop cybercrime group exploited a zero-day SQL injection flaw in Progress Software’s file transfer platform, accessed Delta Dental’s environment between May 27 and May 30, 2023, and exfiltrated about 60,000 files containing sensitive personal, financial, and health information. Delta Dental said the incident affected nearly 7.1 million customers, and breach notices offered affected individuals 24 months of identity monitoring and identity theft protection services.
The New York Department of Financial Services said Delta Dental discovered a web shell on its MOVEit servers on June 1, 2023 but did not notify regulators until Dec. 15, 2023, far beyond the state’s 72-hour reporting requirement. Investigators also found the company lacked adequate written incident response and reporting plans and had weak data retention and secure disposal practices, with some MOVEit folders retaining data longer than the platform’s default 30-day period or having retention disabled entirely. The April 29 consent order imposed the monetary penalty on Delta Dental of New York and Delta Dental Insurance and did not require additional corrective actions beyond compliance with the settlement.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
A consent order dated 2026-04-29 between the New York Department of Financial Services, Delta Dental of New York, and Delta Dental Insurance imposed a $2.25 million penalty over the company's handling of the 2023 MOVEit breach. Regulators said Delta Dental violated state cybersecurity rules on data retention, secure disposal, incident response planning, and timely notification.
Delta Dental notified New York regulators on 2023-12-15, more than six months after identifying the web shell on June 1. New York later said this exceeded the state's 72-hour cyber incident reporting requirement.
On 2023-11-27, Delta Dental determined that the incident affected the recipient's personal information. The breach notice also states that affected individuals were offered 24 months of identity monitoring and identity theft protection through Kroll.
On 2023-07-06, Delta Dental determined that unauthorized access to information stored on its MOVEit platform had occurred. This marked the company's confirmation of the breach following its initial June 1 discovery.
On 2023-06-01, Delta Dental identified a web shell on its MOVEit servers and learned of the incident. The company then disabled access to MOVEit, removed malicious files, applied patches, reset administrative passwords, enhanced monitoring, engaged forensic experts, and notified law enforcement.
Delta Dental disclosed that unauthorized actors exploited a previously unknown MOVEit Transfer vulnerability and accessed and acquired company information without authorization between May 27 and May 30, 2023. Reporting on the incident ties this activity to the broader Clop-linked MOVEit mass exploitation campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceismg-cdn.nyc3.cdn.digitaloceanspaces.com
Open sourceoag.ca.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Delta Dental of Virginia experienced a security incident in which an unauthorized party gained access to a corporate email account between March 21 and April 23, 2025. This breach resulted in the exposure of sensitive information belonging to approximately 146,000 customers, including names, Social Security numbers, government ID numbers, and protected health information. The company detected suspicious activity on April 23 and immediately launched an investigation with the assistance of external cybersecurity experts. There is currently no evidence that the compromised data has been misused, but Delta Dental of Virginia is offering affected individuals complimentary identity protection and credit monitoring services for one year. Delta Dental of Virginia provides dental insurance and manages oral health programs for individuals, families, and employers across the state. The breach notification was filed with the Office of the Maine Attorney General, and the company has taken steps to notify impacted customers. The incident highlights the risks associated with email account compromises in the healthcare sector, particularly regarding the exposure of sensitive personal and health information. No evidence of data abuse has been reported so far, but customers are advised to remain vigilant for potential identity theft or fraud attempts.
Jul 12, 2026
MCNA Dental agreed to a proposed multimillion-dollar settlement to resolve consolidated class action litigation stemming from a 2023 **LockBit** ransomware attack and data theft that exposed the personal, insurance, and health information of nearly **9 million people**. Many of those affected were children enrolled in government-sponsored dental programs, and the incident also impacted more than **100 organizations** connected to MCNA’s services, including state agencies and public benefit entities. The settlement, filed in Florida federal court, provides up to **$2,500** per class member for undocumented out-of-pocket losses, **two years of medical data monitoring**, and **$1 million** in identity theft coverage, along with administrative and legal costs. Plaintiffs alleged MCNA maintained negligent security practices and failed to protect sensitive data before LockBit allegedly demanded **$10 million** and published stolen information when the ransom was not paid; MCNA denied wrongdoing but agreed to continue taking reasonable steps to improve its security posture.
Jun 29, 2026
DentaQuest disclosed a breach after unauthorized actors accessed its network between May 17 and May 20, exposing personal and dental health information tied to more than 23 million individuals. The company said the compromised data may include names, addresses, Social Security numbers, member IDs, Medicaid and Medicare numbers, provider names, diagnoses, treatment details, and billing information; some reporting said vision-related health data may also be involved. Public filings indicate at least 4.5 million notification letters are being sent, while DentaQuest has confirmed that at least 15 million people were affected and broader estimates place the total potential impact above 23.4 million. The **ShinyHunters** extortion group claimed responsibility, alleging it stole about **234 GB** of data and later posted the material on its dark web leak site after ransom talks failed. Reporting on the leaked files found roughly **2.6 million unique email addresses** and a folder that appeared to contain more than **1.7 million Social Security numbers**, many believed to belong to children in Texas. DentaQuest said it secured its systems, notified law enforcement, hired outside cybersecurity experts and **Kroll** to assess the incident, and is offering affected individuals **24 months** of credit monitoring, fraud consultation, and identity theft restoration services.
Jul 27, 2026