Loading story…
QualDerm Partners, a Tennessee-based healthcare management company that supports dermatology practices, disclosed a cyberattack that exposed the personal and protected health information of more than 3.1 million individuals. The company said it detected unusual activity on December 24 and later determined that an unauthorized actor accessed a limited number of internal systems between December 23 and December 24, 2025, and exfiltrated stored data.
The stolen information reportedly included names, dates of birth, medical record numbers, treatment and diagnosis details, health insurance information, and driver’s license numbers, making the incident one of the larger recent healthcare data breaches. QualDerm notified the U.S. Department of Health and Human Services Office for Civil Rights, informed law enforcement and regulators, and began offering affected individuals complimentary identity protection and credit monitoring; the company did not publicly attribute the intrusion, disclose the volume of data taken, or say whether a ransom demand was involved.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By March 25, 2026, QualDerm had publicly disclosed a data breach potentially affecting millions of individuals. The incident involved exposure of sensitive personal and health information tied to the healthcare management company and supported dermatology practices.
By May 21, 2026, QualDerm reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights, notified law enforcement and regulators, and began offering affected individuals complimentary identity protection and credit monitoring. The company said more than 3.1 million individuals were affected.
On December 24, 2025, QualDerm detected unusual activity in its environment. The company said the unauthorized access occurred between December 23 and December 24, 2025, indicating the intrusion ended by that date.
QualDerm Partners determined that an unauthorized actor accessed a limited number of its internal systems beginning on December 23, 2025. During this intrusion window, certain stored information was accessed and later found to have been exfiltrated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple U.S. healthcare organizations reported **unauthorized network access and patient data exposure**, with several incidents involving confirmed **data exfiltration** and follow-on notification/credit-monitoring actions. **QualDerm Partners** disclosed unauthorized access between **Dec. 23–24, 2025** with files exfiltrated and notifications being sent on a rolling basis, while **Carolina Foot & Ankle Associates** reported a **Dec. 2025** intrusion detected after a network disruption and confirmed exfiltration of files containing PHI (e.g., demographics, MRNs, insurance data, and treatment/billing codes). Additional breach disclosures included **Cedar Point Health** (intrusion detected around **June 16, 2025**, with a months-long data review concluding in late Jan. 2026 and impacted data potentially including SSNs/ITINs and government IDs) alongside separate notifications from **Wee Care Pediatrics** and **Easterseals Northeast Indiana**. Legal and regulatory consequences continued to surface from earlier healthcare incidents. **Asheville Eye Associates** agreed to settle consolidated class-action litigation tied to a **Nov. 2024** attack claimed by **DragonForce ransomware**, which allegedly exfiltrated **~540 GB** before encrypting systems and later leaked data when ransom was not paid; the breach was reported to HHS OCR as affecting **204,984** individuals. Sector-wide reporting also indicated **46** large healthcare breaches logged for **Jan. 2026** on the HHS OCR portal (500+ individuals), exposing **~1.44 million** individuals’ PHI, amid discussion that late-2025 reporting backlogs may have influenced recent month-to-month trends.
Jun 29, 2026
DentaQuest disclosed a security incident that exposed sensitive personal and health-related information belonging to nearly 4 million individuals after attackers gained unauthorized access to its internal network. The company said it detected the intrusion on May 20 and later determined the threat actors had been inside since May 17, during which time confidential data was stolen. A filing cited by regulators in Texas put the affected population at up to **3,973,000** people. The compromised data reportedly included names, personal identifiers, and dental or vision information such as provider names, diagnoses, treatments, and billing details. DentaQuest is offering affected individuals two years of identity protection and credit monitoring through **Kroll**. The incident follows claims by **ShinyHunters** that it had breached DentaQuest and obtained more than **2.6 million** unique email addresses along with names, addresses, and phone numbers.
Jul 22, 2026
DentaQuest disclosed a breach after unauthorized actors accessed its network between May 17 and May 20, exposing personal and dental health information tied to more than 23 million individuals. The company said the compromised data may include names, addresses, Social Security numbers, member IDs, Medicaid and Medicare numbers, provider names, diagnoses, treatment details, and billing information; some reporting said vision-related health data may also be involved. Public filings indicate at least 4.5 million notification letters are being sent, while DentaQuest has confirmed that at least 15 million people were affected and broader estimates place the total potential impact above 23.4 million. The **ShinyHunters** extortion group claimed responsibility, alleging it stole about **234 GB** of data and later posted the material on its dark web leak site after ransom talks failed. Reporting on the leaked files found roughly **2.6 million unique email addresses** and a folder that appeared to contain more than **1.7 million Social Security numbers**, many believed to belong to children in Texas. DentaQuest said it secured its systems, notified law enforcement, hired outside cybersecurity experts and **Kroll** to assess the incident, and is offering affected individuals **24 months** of credit monitoring, fraud consultation, and identity theft restoration services.
Jul 27, 2026