Chord Specialty Dental Partners Data Breach: What It Means for DSOs

Ask a dentist where the practice keeps its most sensitive patient records and they will point to the practice-management system. Ask where that data actually piles up, and the honest answer is the email inbox.

The Chord Specialty Dental Partners data breach shows why that second answer matters. Chord is a Tennessee-based dental support organization; its website lists 75+ practices in eight states. According to Chord’s notice, it found suspicious activity in an employee’s email account in September 2024, and an investigation found that an unauthorized person had access to several accounts for a limited time in August and September 2024. The information involved may include Social Security numbers, driver’s licenses, bank and payment-card details, and medical information. Chord reported the breach to federal regulators as affecting 173,430 people. The notice does not say how the accounts were accessed. The lesson for every practice is about what an email account can hold.

Updated October 20, 2026: Chord issued a notice dated October 12, 2026 about an August 2026 incident involving its network. The 2026 notice is summarized at the end of this post.

What happened in the 2024 Chord Specialty Dental Partners breach

Chord’s notice, dated March 14, 2025, says it discovered suspicious activity related to an employee’s email account on or around September 11, 2024, took steps to secure the account and brought in third-party specialists. The investigation found that an unauthorized individual had gained access to several accounts “for a limited time between August 19, 2024, to September 25, 2024.” The notice does not say how long any one account was accessed within that window. Chord reported the breach to the HHS Office for Civil Rights on March 14, 2025.

The information involved varies by person. According to the notice, it may include names, addresses, Social Security numbers, driver’s license numbers, bank account and payment-card information, dates of birth, medical information, and health insurance information. Chord said it was not aware of any evidence that the information had been or would be fraudulently misused, and that it could not rule out that the information had been accessed. The breach drew at least seven proposed class actions in federal courts in Tennessee and Pennsylvania. The Pennsylvania cases were consolidated, and court orders there in 2026 paused deadlines and required the parties to report on settlement negotiations.

Why PHI in your inbox is a breach waiting to happen

Email is where dental data goes to accumulate quietly. An insurance verification here, a scanned ID there, a billing question with an account number attached, a referral with a full history. None of it feels like a filing decision in the moment. But every message stays in the mailbox, and over months and years, a single inbox becomes an unsorted archive of exactly the fields an identity thief wants.

That is why an email-account compromise is so much more damaging than it sounds. Chord’s notice about the 2024 incident does not say how those accounts were accessed, so what follows is the general pattern, not Chord’s story. Many of these takeovers start with an ordinary phishing message, the same everyday attacks we break down in the common IT scams dental practices must avoid. The attacker who takes over a mailbox does not just get to read new messages. They get years of stored correspondence, and in a practice that never cleaned it out, that means Social Security numbers and payment cards sitting in plain reach. The practice-management system might be locked down tight. The inbox next to it, holding copies of the same data, often is not.

Time matters too. In any mailbox takeover, every day an intruder keeps access is another day of stored mail within reach. For your practice, that makes watching how accounts are used as important as locking the front door.

What practices and DSOs should do now

Two fixes follow for any practice: get patient data out of email, and make a break-in visible within hours. You do not need to be technical to push on either one. Four questions to ask your IT provider, and what a good answer sounds like:

• “What patient information is sitting in our email right now, and how far back does it go?” Ask your office manager too. Scanned IDs, insurance cards, billing questions with account numbers, referrals with full histories. A good answer includes a plan to route that traffic through a secure portal or your practice-management system instead, and to clear out what has piled up under an approved retention policy. A mailbox that does not hoard Social Security numbers cannot leak them when it gets hijacked.
• “How does our team sign in to email, and could someone approve a login by accident?” You are listening for a physical security key or an app that makes staff match a number on the screen. Texted codes and tap-to-approve prompts get phished and get approved on reflex, which is how many email takeovers start. Microsoft Research, studying accounts that showed suspicious activity, found that multi-factor authentication cut the risk of account compromise by 98.56% in cases where credentials had already leaked, so this is the highest-return thing on the list even before you upgrade the method. The same research found dedicated authenticator apps outperform SMS codes, which is why the method matters as much as having MFA at all.
• “If someone logged into our email from another country tonight, would we get an alert?” A login from a strange location, a trip that is physically impossible, or a new rule quietly forwarding mail out of the practice should all trip an alarm immediately. A good answer names the alerts that are switched on and who reads them. “We would probably see it eventually” is not an answer.
• “Has anyone reviewed our email system’s settings, or just set it up and left it?” Rules that auto-forward mail outside the practice, old sign-in methods that skip modern security, and staff mailboxes with far more access than the job needs are the quiet levers that let an intruder linger. A good answer is a recent review with findings. The biggest blind spot in dentistry is not the firewall. It is the email environment nobody has looked at since setup day.

The inbox is the soft target

Compromised email accounts show up again and again in dental breach reports. Chord is one of several email-account incidents on our list of the biggest dental data breaches. For your practice, the safeguards are the two fixes above: keep sensitive data out of mailboxes, and watch how the accounts are used.

If you run a DSO, the inbox problem multiplies: every affiliated office has staff mailboxes, and every one of them needs the same login protection and the same monitoring.

That is why our cybersecurity assessments start with the email and identity layer for the groups we protect at Medix Dental IT. We get patient data out of inboxes, put the strongest available login protection on every mailbox, and set up monitoring so a break-in surfaces fast. None of it is exotic, and none of it requires you to understand the plumbing. It requires someone to actually look.

So here is the question worth sitting with. If an attacker logged into one of your practice’s mailboxes tonight, how long would it take you to know? If you do not know the answer, that is where your next conversation with your IT provider should start.

Chord’s 2026 notice

Chord issued a new notice dated October 12, 2026. It said that on or around August 13, 2026, CDHA Holdings, LLC d/b/a Chord Specialty Dental Partners “became aware of unauthorized activity on our network,” and said it “took immediate action to secure the network” and engaged third-party specialists. The investigation found that certain information on the network “may have been accessed without authorization between August 11, 2026, and August 13, 2026.” The notice said Chord was conducting a review of the potentially impacted data.

According to the notice, the affected files may have included certain patients’ protected health information. The categories listed include dates of birth, Social Security numbers, driver’s license or other government ID numbers, financial account information, medical record numbers, treatment and diagnosis information, health insurance policy numbers, Medicaid or Medicare numbers, claims and billing information, prescription information, and dates of service. Not every category applied to every person. The notice said Chord had no indication that any information had been fraudulently misused.

The notice did not give a number of people affected or say how the access happened. It was issued by CDHA Holdings, LLC; the 2025 notice was issued by CDHA Management, LLC and Spark DSO, LLC. The 2026 notice did not link the two incidents.

Posted in Dental Cybersecurity, News