Loading story…
DentaQuest disclosed a security incident that exposed sensitive personal and health-related information belonging to nearly 4 million individuals after attackers gained unauthorized access to its internal network. The company said it detected the intrusion on May 20 and later determined the threat actors had been inside since May 17, during which time confidential data was stolen. A filing cited by regulators in Texas put the affected population at up to 3,973,000 people.
The compromised data reportedly included names, personal identifiers, and dental or vision information such as provider names, diagnoses, treatments, and billing details. DentaQuest is offering affected individuals two years of identity protection and credit monitoring through Kroll. The incident follows claims by ShinyHunters that it had breached DentaQuest and obtained more than 2.6 million unique email addresses along with names, addresses, and phone numbers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
DentaQuest disclosed a data security incident affecting up to 3,973,000 individuals and said exposed data included personal identifiers and dental or vision health information. The company also offered affected people two years of identity protection and credit monitoring through Kroll.
In May, the ShinyHunters group claimed it had breached DentaQuest and stolen more than 2.6 million unique email addresses along with names, addresses, and phone numbers. The source does not provide a specific day for the claim.
DentaQuest said it detected unauthorized access to its internal network on May 20. This detection prompted an investigation into the scope and impact of the incident.
DentaQuest's investigation found that attackers gained access to its internal network on May 17. The intrusion ultimately led to the theft of sensitive personal and health-related information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DentaQuest disclosed a breach after unauthorized actors accessed its network between May 17 and May 20, exposing personal and dental health information tied to more than 23 million individuals. The company said the compromised data may include names, addresses, Social Security numbers, member IDs, Medicaid and Medicare numbers, provider names, diagnoses, treatment details, and billing information; some reporting said vision-related health data may also be involved. Public filings indicate at least 4.5 million notification letters are being sent, while DentaQuest has confirmed that at least 15 million people were affected and broader estimates place the total potential impact above 23.4 million. The **ShinyHunters** extortion group claimed responsibility, alleging it stole about **234 GB** of data and later posted the material on its dark web leak site after ransom talks failed. Reporting on the leaked files found roughly **2.6 million unique email addresses** and a folder that appeared to contain more than **1.7 million Social Security numbers**, many believed to belong to children in Texas. DentaQuest said it secured its systems, notified law enforcement, hired outside cybersecurity experts and **Kroll** to assess the incident, and is offering affected individuals **24 months** of credit monitoring, fraud consultation, and identity theft restoration services.
Jul 27, 2026
DentaQuest, a major U.S. dental benefits administrator owned by Sun Life, disclosed a cybersecurity incident involving unauthorized access to a limited portion of its network, exposing sensitive information tied to **2.6 million accounts**. The breach was first publicized by the extortion group **ShinyHunters**, which claimed to have stolen more than **234 GB** of data and later leaked the dataset after an alleged failure to reach an agreement with the company. Analysis of the leaked data found records containing email addresses, full names, phone numbers, dates of birth, genders, government-issued IDs, and health insurance information. DentaQuest said its systems remained operational and customer service saw only limited disruption while external experts investigated the scope of the compromise, but the exposed data significantly increases the risk of phishing, social engineering, identity theft, and related fraud targeting affected individuals.
Jun 29, 2026
QualDerm Partners, a Tennessee-based healthcare management company that supports dermatology practices, disclosed a cyberattack that exposed the personal and protected health information of more than **3.1 million** individuals. The company said it detected unusual activity on December 24 and later determined that an unauthorized actor accessed a limited number of internal systems between December 23 and December 24, 2025, and exfiltrated stored data. The stolen information reportedly included names, dates of birth, medical record numbers, treatment and diagnosis details, health insurance information, and driver’s license numbers, making the incident one of the larger recent healthcare data breaches. QualDerm notified the U.S. Department of Health and Human Services Office for Civil Rights, informed law enforcement and regulators, and began offering affected individuals complimentary identity protection and credit monitoring; the company did not publicly attribute the intrusion, disclose the volume of data taken, or say whether a ransom demand was involved.
Jun 29, 2026