The 13 Biggest Dental Data Breaches of All Time

No dental practice thinks it is a target until the morning the schedule will not load.

The biggest dental data breaches of the last several years should put that idea to rest for good. Dental practices, multi-location groups, and the insurers behind them hold exactly the data attackers want: Social Security numbers, government IDs, financial accounts, insurance details, and treatment records, often for entire families and, in the Medicaid cases, millions of children. The breaches below are ranked by the number of people affected, and each one carries a specific lesson for any practice or group holding the same kind of data. Medix Dental IT has spent more than 20 years securing dental environments, so this is written from the defender’s side of the table, not as a scare piece.

The 13 Biggest Dental Data Breaches of All Time

The Biggest Dental Data Breaches at a Glance

Rank	Organization	People Affected	Year	Attack Vector
1	DentaQuest (benefits administrator)	27,400,000+	2026	Data theft and extortion, claimed by ShinyHunters
2	MMG Fusion (software vendor)	~15,000,000	2020	Network intrusion, OCR alleged notification failures
3	MCNA Dental (benefits administrator)	8,923,662	2023	Ransomware, claimed by LockBit
4	Delta Dental of California (insurer)	6,928,932	2023	MOVEit supply-chain zero-day
5	Great Expressions Dental Centers (DSO)	1,925,397	2023	Network intrusion
6	Dental Care Alliance (DSO)	1,723,375	2020	Network intrusion
7	Absolute Dental (dental group)	1,223,635	2025	Apparent malicious-tool execution via MSP-associated account
8	Risas Dental & Braces (dental group)	618,189	2023	Network intrusion
9	Park Dental / The Dental Specialists (dental groups)	277,109	2024	Email-account compromise
10	First Choice Dental (dental group)	228,287	2023	Ransomware
11	Chord Specialty Dental Partners (DSO)	173,430	2024	Email-account compromise
12	Professional Dental Alliance (dental group)	172,933	2021	Vendor phishing compromise
13	Henry Schein (distributor / software)	166,432	2023	Ransomware, claimed by BlackCat

1. DentaQuest: More Than 27.4 Million Records (2026)

DentaQuest is a Sun Life subsidiary and one of the largest administrators of Medicaid and CHIP dental benefits in the country. In 2026, the ShinyHunters extortion group claimed responsibility for an attack on the company. Attackers reached part of DentaQuest’s network between May 17 and May 20, 2026, and the extortion group later published roughly 234GB it said came from the company. Notification letters began going out on a rolling basis on July 17, 2026, and DentaQuest first confirmed that at least 15 million individuals were affected, the figure on its HHS breach portal report. Filings with the Texas, Massachusetts and South Carolina attorneys general alone account for more than 4.5 million notification letters, and an independent researcher who deduplicated the leaked files by name and date of birth put an earlier estimate at roughly 23.4 million, with roughly 1.7 million unique Social Security numbers found in a single folder. Then, in an updated notice to the Washington attorney general dated August 3, 2026, DentaQuest said it is aware of more than 27.4 million individuals whose data was accessed. The count passed the estimate, and the gap between the first number and the latest one is the point. We covered the incident and what it means for practices in our DentaQuest data breach analysis.

Early coverage of this breach put the figure at 2.6 million, which counted unique email addresses in the leaked dataset. Treat early breach counts as provisional and revisit them.

The pattern here echoes MCNA and Delta Dental: most of the biggest counts in dentistry come from the benefits administrators and insurers, because they aggregate identity data for millions of patients, many of them children in public dental programs, in one place. Concentrating that much identity data makes these organizations attractive extortion targets, and the November 2026 ransomware claim against Delta Dental of Missouri, still unconfirmed, is the newest example. That reality demands the enterprise-grade controls to match, continuous monitoring, tight segmentation so one foothold cannot reach the whole store, and an extortion-response plan built before the ransom note arrives.

2. MMG Fusion: About 15 Million Records (2020)

MMG Fusion, a Maryland software vendor that sold practice-management and marketing tools to dental and oral-healthcare providers, was the subject of a 2026 federal enforcement settlement. An unauthorized actor gained access to MMG’s network on December 21, 2020 and reached protected health information, names, phone numbers, addresses, email addresses, dates of birth, and appointment details, belonging to roughly 15 million dental patients across its provider clients, per the HHS Office for Civil Rights settlement.

What makes this the cautionary tale of the list is what came after the intrusion. OCR opened its investigation in March 2023 after a complaint about an unreported security incident, and among the potential violations it listed was a failure to notify the covered entities affected by the breach. OCR announced the settlement in March 2026: $10,000 and a three-year corrective action plan, an amount OCR said reflected MMG’s financial condition. The agreement resolves potential violations and is not an admission of liability by MMG. OCR called it the 12th enforcement action in its Risk Analysis Initiative, which centers on the requirement to keep an accurate and thorough risk analysis. The lesson for every practice and DSO is that your software vendor is holding your patients’ data under your name, and a business associate that does not report a breach can delay your discovery and your patient notifications. Treat vendor breach-notification clauses and the right to audit as working protections. They are how you find out about a vendor’s incident in time to act. Our study of dental vendor data breaches found no entry on the HHS breach portal that we could tie to the MMG incident.

3. MCNA Dental: 8.9 Million Records (2023)

MCNA Dental, one of the largest administrators of government-sponsored dental benefits in the country, suffered one of the biggest dental-sector breaches on record. An attacker gained access to MCNA’s network on February 26, 2023, and MCNA discovered the intrusion on March 6. The LockBit ransomware gang later claimed the attack, said it had taken around 700GB of data and demanded a $10 million ransom. LockBit said MCNA refused to pay, and the gang published the data it said it had stolen. The final count was 8,923,662 individuals, many of them children enrolled in Medicaid and CHIP dental programs, along with their parents and guardians.

The lesson is dwell time. Eight days passed between the attackers getting in and MCNA discovering the intrusion, and MCNA’s notice says the attacker was able to see and take copies of information between February 26 and March 7. In any breach, that gap between getting in and getting caught is where the damage grows. On your own network, endpoint detection that flags lateral movement and bulk transfers in hours, not days, can be the difference between an incident and a catastrophe. We broke down those eight days in our MCNA Dental data breach analysis.

4. Delta Dental of California: 6.9 Million Records (2023)

Delta Dental of California and its affiliates were caught in the MOVEit mass-hack, the year’s defining supply-chain attack. The Clop ransomware group exploited a zero-day vulnerability in Progress Software’s MOVEit file-transfer tool before any patch existed, exfiltrating data from thousands of organizations that used it. For Delta Dental of California, that meant 6,928,932 individuals exposed, including Social Security numbers, financial accounts, and passport numbers.

The technical flaw was in the vendor’s software, not Delta Dental’s. The regulatory findings came later, and they concerned file retention, incident planning, and regulatory reporting. In an April 2026 consent order, New York’s financial regulator found that two affiliates, Delta Dental Insurance Company and Delta Dental of New York, violated its cybersecurity rules. They use Delta Dental of California’s security program, which had no written procedure for approving longer file retention (many MOVEit folders kept files past the tool’s 30-day default) and an incident-response policy and plan without enough guidance on regulatory reporting. The two affiliates notified the regulator on December 15, 2023, more than six months after the first alert on June 1. They agreed to pay $2.25 million, and the order credits their cooperation. The lesson is that you inherit your vendors’ risk. You cannot outsource the obligation to vet third-party tools, minimize the data you hand them, and notify on time. Our Delta Dental data breach analysis goes deeper on the findings behind the fine.

5. Great Expressions Dental Centers: 1.9 Million Records (2023)

Great Expressions Dental Centers, a DSO operating around 246 practices across nine states at the time, was breached over a six-day window in February 2023. Attackers infiltrated its IT systems between roughly February 17 and 22 and reached a wide set of patient data, names, dates of birth, Social Security numbers, and dental and medical records, along with employee banking information. The final count was 1,925,397 individuals, and the company later settled a class action for $2.7 million, per HIPAA Journal.

This is the DSO risk-concentration lesson repeating at scale. A group supporting hundreds of practices centralizes patient records into systems that, once breached, can expose patient data across the group. For your group, the defenses are the ones this whole list keeps pointing back to: endpoint detection that flags lateral movement in hours, segmentation so a single foothold cannot reach every practice’s data, and data minimization so the most sensitive fields are not sitting together in one reachable place. Our Great Expressions data breach analysis covers the incident and lessons for multi-location groups.

6. Dental Care Alliance: 1.7 Million Records (2020)

Dental Care Alliance, a DSO supporting more than 320 affiliated practices across about 20 states at the time, was described in contemporaneous reporting as one of the largest healthcare breaches disclosed in 2020. By HIPAA Journal’s year-end ranking it landed fifth, behind Trinity Health, MEDNAX, Inova Health System, and Magellan Health. Attackers accessed the network over a window of nearly a month in fall 2020, from September 18 to October 13, and reached patient files; the count was initially reported at 1,004,304 and later amended upward to 1,723,375. A subset had Social Security numbers, financial accounts, or driver’s license numbers exposed. The case settled for $3 million in 2022.

The takeaway is structural. A DSO that aggregates protected health information from hundreds of practices becomes a single high-value target, and the longer an attacker stays inside a repository that large, the more it can reach. Every practice a group acquires either raises or lowers that risk, which is why IT due diligence before an acquisition is as much a security control as a financial one. Centralization is a strength operationally and a risk concentration in security terms. The same platform that makes a group efficient makes it a bigger prize. Our Dental Care Alliance data breach analysis covers the incident and what to ask about IT risk before an acquisition.

7. Absolute Dental: 1.2 Million Records (2025)

Absolute Dental, a Nevada group with more than 50 locations, disclosed a breach apparently linked to an account associated with its IT vendor. According to the group’s breach notice, the unauthorized access appears to have come from the inadvertent execution of a malicious version of a legitimate software tool, through an account associated with its managed services provider. The breach affected 1,223,635 people. The court granted preliminary approval of a $3.3 million class-action settlement in March 2026 and final approval on July 30, 2026. The claims against the IT consulting firm named alongside Absolute Dental were not resolved by that settlement and are still being litigated. The full account of the incident, and what the notice does and does not say, is in our Absolute Dental data breach analysis, and our study of dental data breach lawsuits compares its settlement with 11 others.

This case matters because the access appears to have come through an account associated with a trusted IT vendor. The lesson for every practice and DSO that outsources IT is that your vendor’s access is your attack surface. Limit what each vendor account can reach, require phishing-resistant MFA on it, and monitor remote-access sessions.

8. Risas Dental & Braces: 618,000 Records (2023)

Risas Dental & Braces, a multi-state group across Arizona, Colorado, Texas, and Nevada, discovered unusual activity on its systems on July 10, 2023. Its forensic investigation found that certain files stored on its systems may have been downloaded without authorization, affecting 618,189 individuals. Notably, the notice said the information did not include patients’ Social Security numbers, detailed treatment information or treatment records, while several smaller breaches on this list involved Social Security numbers.

That contrast is the lesson. Breach severity is not just headcount, it is what data was reachable. Based on its notice, the data involved did not amount to the full identity-theft kit. Segmenting and minimizing the most sensitive data, so that a server compromise does not automatically mean SSNs walk out the door, is what shrinks the blast radius if an attacker gets in.

9. Park Dental and The Dental Specialists: 277,000 Records (2024)

Two affiliated Minnesota dental groups, Park Dental and The Dental Specialists, disclosed a combined 277,109 affected patients (238,667 and 38,442) from a single email-account compromise in January 2024. According to their notices, an unauthorized actor had access to a limited number of employee email accounts in their Microsoft 365 environment between January 11 and January 23, 2024. Both groups said they had safeguards in place, such as multifactor authentication prompts, and that they were reviewing and strengthening them. Neither notice says how the attacker got in.

The lesson for your practice is that having MFA is not the finish line. Push prompts and SMS codes can be defeated by phishing, token theft, and prompt-bombing, which is why phishing-resistant MFA (hardware security keys or passkeys) matters. Number matching helps against prompt-bombing, but it is not phishing-resistant. The other lesson is to keep patient data out of email. PHI that lives in a mailbox can turn one compromised account into a six-figure breach.

10. First Choice Dental: 228,000 Records (2023)

First Choice Dental, a group of clinics in and around Madison, Wisconsin, detected a ransomware event in October 2023. The attacker encrypted some data and tried to extort a ransom, and the files involved may have included a high-severity mix: names, Social Security numbers, passport numbers, driver’s licenses, financial accounts, and health information. The practice notified 228,287 people, the class-action settlement class was defined as 159,145 individuals, and First Choice agreed to a settlement valued at up to $1,225,000.

First Choice’s notice shows a two-stage notification pattern worth understanding. It posted a notice on its website and placed a newspaper notice on December 21, 2023, while its review of the affected files was still under way, then mailed personalized letters on July 16, 2024, once that review was complete. Before you ever need it, know how the 60-day HIPAA notification clock works, including when website and media notice come into play, so your notification plan runs alongside recovery instead of after it.

11. Chord Specialty Dental Partners: 173,000 Records (2024)

Chord Specialty Dental Partners, a Tennessee-based DSO whose website lists 75+ practices in eight states, reported an email-account compromise affecting 173,430 individuals. According to Chord’s notice, an unauthorized person had access to several email accounts for a limited time between August 19 and September 25, 2024, and Chord discovered suspicious activity around September 11. It posted its notice in March 2025. The information involved varies by person and may include Social Security numbers, driver’s licenses, bank and payment-card details, and medical information. The breach triggered at least seven class-action lawsuits.

The pattern repeats: patient data sitting in email accounts. For your practice, the defensive playbook is phishing-resistant MFA on every mailbox, anomalous-login alerting to shorten detection time, and a hard rule that sensitive data does not live in inboxes. Our Chord Specialty Dental Partners data breach analysis lays out the four questions to put to your IT provider about mailbox security.

In October 2026, Chord issued a notice about an August 2026 incident involving its network. It said information on its network may have been accessed without authorization between August 11 and 13, 2026, and that it was reviewing the affected data. That notice gave no count, so this entry and the table reflect the 2024 incident only.

12. Professional Dental Alliance: 173,000 Records (2021)

Professional Dental Alliance’s breach happened at its vendor, North American Dental Management. According to PDA’s notice and its HHS reports, the vendor’s employees were targeted in an email phishing attack, and an unauthorized person accessed a few of the vendor’s email accounts that held patient information for affiliated practices across 10 states. The cascade reached 172,933 individuals in total across those affiliated practices, with Social Security numbers and financial accounts among the exposed data.

This is the business-associate version of the MSP problem. One vendor’s email compromise reached patients of affiliated practices in 10 states. The lesson is that vendor risk management is patient-data security: a business associate’s email defenses, MFA, and phishing training are effectively your own, and they belong in your risk assessment and your contracts.

13. Henry Schein: 166,000 Records (2023)

Henry Schein, the dental industry’s largest distributor and the company behind widely used practice-management software, disclosed two cyber incidents in fall 2023, and the BlackCat ransomware gang claimed responsibility. Henry Schein said the same threat actor was behind both. It discovered the first incident on October 14, 2023, and disclosed it the next day. In its SEC filing, Henry Schein said its practice-management software business, Henry Schein One, was not affected by the October incident. The attackers claimed to have stolen around 35TB of data, a figure Henry Schein never confirmed. On November 2, BlackCat claimed it had re-encrypted files after ransom negotiations stalled. On November 22, Henry Schein said another incident from the same threat actor had taken applications, including its eCommerce platform, offline again. The gang also threatened a third attack. The final count was 166,432 individuals, revised up from an initial 29,112. Henry Schein reached a $2.9 million class-action settlement. Our comparison of public dental companies’ SEC cybersecurity disclosures also looks at how Henry Schein describes its risk management.

The second disruption is the lesson most organizations miss. Backups are necessary but not sufficient. In any recovery, if an attacker can come back, restored systems can be hit again. Recovery has to happen in an isolated, verified-clean environment, and your largest vendors are single points of failure whose outages can freeze ordering and other services for practices nationwide.

The Most Common Threats Dental Practices and DSOs Face Today

Read these cases back to back and the same handful of attack patterns appear again and again. These are the threats to plan for now.

Ransomware and data-theft extortion. Gangs like LockBit and BlackCat encrypt systems and leak stolen data to force payment. Dental practices are attractive because encrypted systems halt scheduling, billing, and care across every location at once. The defense is immutable, offline backups tested with real restore drills, endpoint detection on every device, and network segmentation so one practice’s breach cannot reach the whole group.

Supply-chain and vendor exposure. The Delta Dental of California breach involved an exploit of MOVEit Transfer, a third-party file-transfer application the company used. The more recent DentaQuest breach shows concentration risk from the benefits side: data on patients from many practices sat with one administrator, and DentaQuest’s notices do not say how the attackers got in. The ransomware claim against dental billing vendor eAssist has since been followed by eAssist’s acknowledgment of data exfiltration. In customer communications shared with us, eAssist said that data was exfiltrated from an eAssist system, though its investigation has not established which customers or patients may have been affected. The claim appeared on a leak site two days before eAssist notified its customers, a reminder that a practice can hear about a vendor incident from a leak site before it hears from the vendor. When the dental sector runs on a small set of shared platforms, one vendor incident can expose millions. The defense is a vendor inventory and risk register, patch SLAs and breach-notification clauses in contracts, and minimizing the data you share with any third party.

MSP and IT-vendor access. At Absolute Dental, the access appears to have come through an account associated with its IT provider. Practices and even mid-size DSOs can give an MSP deep, standing access through management tools. The defense is least-privilege and just-in-time access for vendors, phishing-resistant MFA on every MSP account, and monitoring of remote-management tool usage.

Email-account compromise. The Park Dental, Chord, and Professional Dental Alliance incidents all involved compromised email accounts that held patient data. The defense is phishing-resistant MFA rather than push prompts or SMS codes, conditional access rules, mailbox anomaly alerting, and a discipline of never letting PHI accumulate in email.

Phishing and credential theft. Several of the breaches above involved compromised email accounts, including accounts at a vendor. Stolen credentials can let an attacker log in as a trusted user and operate undetected, especially where no one is watching for unusual sign-ins. The defense is MFA everywhere, recurring phishing simulations, and an email gateway that detonates links and attachments before they reach staff.

The pattern underneath the cases with public details: they involve trusted identities and trusted third parties, a compromised mailbox, a vendor’s account or a vendor’s software, each of which can sit in front of a large store of patient data. For a DSO, centralization multiplies the damage, because one compromised identity or vendor can expose data from many practices at once. That is why so many of the names above are multi-location groups and management companies rather than single chairs.

What This Means for Your Practice or Group

None of the defenses these breaches point to are exotic. The baseline is consistent across these cases: phishing-resistant multifactor authentication, endpoint detection and response on every device, identity governance inside your Microsoft 365 or Google Workspace tenant, immutable and tested backups, a vendor risk register, data minimization so you are not hoarding records you no longer need, and an incident-response plan you have actually rehearsed. We set out what that plan has to cover in the first hour, including the evidence mistakes that widen the notification list. Microsoft Research, studying accounts that showed suspicious activity, found that multifactor authentication reduced the risk of account compromise by 99.22% across that population, and by 98.56% in cases where credentials had already leaked. Several of the breaches above involved compromised accounts. The financial stakes are not abstract either. IBM’s 2026 Cost of a Data Breach report put the average healthcare breach at $6.64 million, down from $7.42 million the year before. The figure fell, but healthcare still carries the highest breach costs of any industry, and it has held that spot for thirteen straight years.

One question we get constantly right now is whether to wait for the new HIPAA Security Rule before investing in any of this. The short answer is no. The proposed update, which would make several controls that are currently “addressable” into explicit requirements, including MFA, encryption, and asset inventories, was published in the Federal Register on January 6, 2025. The comment period closed that March with roughly 4,700 comments, OCR’s own target of a May 2026 final rule passed with nothing published, and the federal regulatory agenda now points to 2027. There is no final rule, and OCR has not confirmed whether the proposal will reach one in its current form.

That timeline is easy to misread as breathing room. It is not. The existing Security Rule is fully in force and OCR is actively enforcing it, and every control in the proposal is already what we would put in front of a client as a reasonable security program. Practices and groups that build toward it now are not gambling on a rule that may change. They are closing the kinds of gaps attackers look for.

The same threats show up in the everyday attacks that never make headlines, which we cover in the common IT scams dental practices must avoid and in how AI is reshaping dental cybersecurity threats. The recovery half of the equation, the part that decides whether a breach is a bad week or a closed practice, lives in dental data backup and disaster recovery.

Final Thoughts from Tom Terronez

Where the cause is public, the risks look familiar in hindsight. A compromised mailbox, a vendor’s account, a flaw in shared software. What I’ve seen in the smaller incidents that never make a list like this is that the practices that get hurt are rarely the ones that did something exotic wrong. They are the ones that treated cybersecurity as antivirus plus a checkbox instead of a real program, and then learned the difference during an incident.

If you want an honest read on where your practice or group actually stands against these patterns, our team runs HIPAA cybersecurity assessments and managed IT support for dental service organizations against exactly this baseline. If you want a second set of eyes before something forces the conversation, happy to compare notes.

Biggest Dental Data Breaches FAQs

What was the biggest dental data breach ever?

The 2026 DentaQuest breach. The ShinyHunters extortion group published roughly 234GB of data it said was stolen from the company, notification letters began going out on July 17, 2026, and in an updated notice to the Washington attorney general dated August 3, 2026, DentaQuest said more than 27.4 million people’s data was accessed. Its HHS breach portal report lists 15,000,000. The MMG Fusion breach is second, at roughly 15 million dental patients after a software vendor’s network was accessed in December 2020. OCR opened its investigation in 2023 after a complaint about an unreported incident and announced a settlement in March 2026. After those two, the largest is the 2023 MCNA Dental ransomware attack at 8,923,662 individuals, followed by Delta Dental of California at 6,928,932 through the MOVEit supply-chain attack the same year.

What is the largest healthcare data breach in history?

The largest healthcare data breach on record is the 2024 ransomware attack on Change Healthcare, which affected roughly 192.7 million individuals, according to HIPAA Journal’s running tally of federal breach reports. Anthem’s 2015 breach at 78.8 million is second, followed by Conduent Business Services at 62.2 million in 2025. No dental-sector breach reaches those totals, because the largest counts come from clearinghouses, insurers and large healthcare service vendors that hold records for tens of millions of people. DentaQuest still belongs in that conversation, though. On HIPAA Journal’s all-time table, which uses DentaQuest’s 15,000,000 HHS figure, DentaQuest already ranks fourth, ahead of well-known incidents at Kaiser, HCA Healthcare, and Premera Blue Cross. At the more than 27.4 million in its August update, it would still rank fourth, behind Conduent.

How do most dental data breaches actually happen?

Where details are public, the breaches on this list involved a trusted identity or a trusted third party: compromised email accounts, apparent access through an account associated with an IT vendor, or a zero-day in shared vendor software. Those accounts and systems can hold large stores of patient data. That pattern comes from the biggest breaches. Across the 184 dental reports on the HHS list since 2019 whose cause we could trace, 151 started on the organization’s own systems, staff, devices or mail rather than at a vendor, though that list doesn’t reliably capture vendor breaches.

Are small dental practices targets, or just large groups and insurers?

Both. Large groups and insurers produce the biggest headline counts because they aggregate the most data, but small practices are breached constantly through the same phishing and vendor-compromise routes. Westend Dental, an Indianapolis practice, is a small-practice example. Indiana’s attorney general alleged that Westend was hit by ransomware in 2020 and concealed it, telling state investigators the data was lost when a server hard drive was formatted by mistake. Westend agreed to pay $350,000 to the state in a consent judgment the federal court entered in January 2025. Size determines the headline number, not the risk of being hit.

What is the single most effective defense against these breaches?

Phishing-resistant multifactor authentication on every account, because compromised accounts come up more than any other factor in the cases where details are public. Microsoft Research, studying accounts that showed suspicious activity, measured MFA reducing the risk of account compromise by 99.22% across that population, and by 98.56% where credentials had already leaked. It is not the only control you need, but several of the breaches above involved an identity that phishing-resistant MFA is built to protect. Pair it with endpoint detection, immutable backups, and vendor access controls for a real program.

Posted in Dental Cybersecurity