Loading story…
DentaQuest disclosed a breach after unauthorized actors accessed its network between May 17 and May 20, exposing personal and dental health information tied to more than 23 million individuals. The company said the compromised data may include names, addresses, Social Security numbers, member IDs, Medicaid and Medicare numbers, provider names, diagnoses, treatment details, and billing information; some reporting said vision-related health data may also be involved. Public filings indicate at least 4.5 million notification letters are being sent, while DentaQuest has confirmed that at least 15 million people were affected and broader estimates place the total potential impact above 23.4 million.
The ShinyHunters extortion group claimed responsibility, alleging it stole about 234 GB of data and later posted the material on its dark web leak site after ransom talks failed. Reporting on the leaked files found roughly 2.6 million unique email addresses and a folder that appeared to contain more than 1.7 million Social Security numbers, many believed to belong to children in Texas. DentaQuest said it secured its systems, notified law enforcement, hired outside cybersecurity experts and Kroll to assess the incident, and is offering affected individuals 24 months of credit monitoring, fraud consultation, and identity theft restoration services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
DentaQuest disclosed that the breach potentially affected more than 23 million people, with public filings indicating at least 4.5 million notification letters were being sent and the company confirming at least 15 million affected. The company also offered 24 months of free credit monitoring, fraud consultation, and identity theft restoration services to affected individuals.
The ShinyHunters extortion group claimed responsibility for the DentaQuest intrusion and said it stole about 234 GB of data. Reporting cited in the references says the group published the data on its dark web leak site after ransom negotiations failed.
DentaQuest said it discovered the incident on May 20, 2026. After discovery, the company secured its systems, notified law enforcement, engaged outside cybersecurity experts, and retained Kroll to identify affected individuals and assess the breach's scope.
DentaQuest said unauthorized actors accessed its computer network between May 17 and May 20, 2026, exposing personal and dental health information. The potentially compromised data included names, addresses, Social Security numbers, member and government insurance IDs, provider names, diagnoses, treatment details, and billing information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DentaQuest disclosed a security incident that exposed sensitive personal and health-related information belonging to nearly 4 million individuals after attackers gained unauthorized access to its internal network. The company said it detected the intrusion on May 20 and later determined the threat actors had been inside since May 17, during which time confidential data was stolen. A filing cited by regulators in Texas put the affected population at up to **3,973,000** people. The compromised data reportedly included names, personal identifiers, and dental or vision information such as provider names, diagnoses, treatments, and billing details. DentaQuest is offering affected individuals two years of identity protection and credit monitoring through **Kroll**. The incident follows claims by **ShinyHunters** that it had breached DentaQuest and obtained more than **2.6 million** unique email addresses along with names, addresses, and phone numbers.
Jul 22, 2026
DentaQuest, a major U.S. dental benefits administrator owned by Sun Life, disclosed a cybersecurity incident involving unauthorized access to a limited portion of its network, exposing sensitive information tied to **2.6 million accounts**. The breach was first publicized by the extortion group **ShinyHunters**, which claimed to have stolen more than **234 GB** of data and later leaked the dataset after an alleged failure to reach an agreement with the company. Analysis of the leaked data found records containing email addresses, full names, phone numbers, dates of birth, genders, government-issued IDs, and health insurance information. DentaQuest said its systems remained operational and customer service saw only limited disruption while external experts investigated the scope of the compromise, but the exposed data significantly increases the risk of phishing, social engineering, identity theft, and related fraud targeting affected individuals.
Jun 29, 2026
QualDerm Partners, a Tennessee-based healthcare management company that supports dermatology practices, disclosed a cyberattack that exposed the personal and protected health information of more than **3.1 million** individuals. The company said it detected unusual activity on December 24 and later determined that an unauthorized actor accessed a limited number of internal systems between December 23 and December 24, 2025, and exfiltrated stored data. The stolen information reportedly included names, dates of birth, medical record numbers, treatment and diagnosis details, health insurance information, and driver’s license numbers, making the incident one of the larger recent healthcare data breaches. QualDerm notified the U.S. Department of Health and Human Services Office for Civil Rights, informed law enforcement and regulators, and began offering affected individuals complimentary identity protection and credit monitoring; the company did not publicly attribute the intrusion, disclose the volume of data taken, or say whether a ransom demand was involved.
Jun 29, 2026