November 6th, 2026
Delta Dental of Missouri Data Breach: What It Means for Dental Practices
Industry Research — Dental Cybersecurity, News
A ransomware group has named a dental insurer on its leak site, and dental offices may start fielding patient questions before the facts are clear.
On November 5, 2026, ransomware tracker Ransomware.live recorded a listing by a group called N0n naming Delta Dental of Missouri, a dental benefits insurer. So far, the Delta Dental of Missouri data breach is a claim made by the attacker, and the company says it is investigating.
The short answer: Delta Dental of Missouri has not confirmed a breach. N0n claims member records with names, Social Security numbers, birth dates, home addresses and dental treatment details, plus 48,528 email addresses and 17,913 phone numbers. None of it is independently verified. For a dental practice, the listing alone does not mean a breach at your office or start your own notification duties: a dental plan is a HIPAA covered entity with duties of its own. Your work now is a front desk script, a phishing warning for the billing team, tighter payer portal logins, and a short paper trail. Groups that bill centrally should give all four one owner.
What is actually known about the Delta Dental of Missouri breach claim
The listing exists. Ransomware.live, which indexes leak sites, recorded the posting at 04:52 UTC on November 5.
The company has responded. According to Becker’s Dental Review, Delta Dental of Missouri said it is aware of a posting by a purported threat actor, has engaged independent forensic specialists, and that its systems and services remain operational.
What we have not found: an incident notice on the company’s website, or an entry on the federal HHS breach portal or the California, Oregon or Washington attorney general breach lists. That absence does not tell you whether a breach occurred, and our study of dental businesses named on ransomware leak sites found no public breach filing for most of them. A covered entity that discovers a breach of unsecured protected health information must notify the people affected without unreasonable delay and no later than 60 calendar days after discovery.
Three claims being repeated, checked
“The data has already been leaked.” Not shown so far. The group tags the listing “not paid” and “exposed,” and at least one AI search answer reads that as proof the data is public. But the listing as captured is headed “What will be published if no settlement is reached,” and the site says data goes public when a countdown runs out. Publication may be coming. The capture does not show it has happened.
“This is the Delta Dental MOVEit breach.” It is not. The 2023 MOVEit breach was reported by Delta Dental of California and its affiliates, and Delta Dental of Missouri is not among the affiliates that notice names. See our breakdown of the 2023 Delta Dental MOVEit breach.
“Every Delta Dental member is affected.” There is no verified count of affected members. Delta Dental of Missouri is one company in the Delta Dental Plans Association’s national network, and the listing names it alone.
What N0n claims it took
The listing gives no member count and no total data size, and its email and phone figures count contact records, not people.
| What the listing claims | Why it matters to a practice |
|---|---|
| “48,528 distinct email addresses and 17,913 telephone number lines” | Contact details are what fake insurer emails and calls run on |
| Member records with “full names, social security numbers, dates of birth, home addresses and dental treatment details” | The details used to open credit, or to pass a front desk identity check |
| “Employer group client records” and “the insurance broker channel that serves them” | Employers and brokers. The listing does not mention dentist or provider data |
Why a payer breach is not a vendor breach
The eAssist and iDentalSoft incidents involved vendors that handle protected health information on a practice’s behalf, which makes them business associates with notice duties to the practice.
An insurer sits in a different place. HIPAA lists a health plan as a covered entity in its own right, and when Delta Dental of Missouri processes your claims, it does that work for itself, not for you. If the plan has a breach of unsecured member data, the duty to notify those members sits with the plan under 45 CFR 164.404, or with the employer’s plan when an employer self-funds and Delta Dental only administers it. Your own duties do not start because a patient’s insurer was named. They depend on discovering a breach of unsecured protected health information your practice is responsible for, including one at your own business associates. Where this does reach you is the front desk and the billing office.
What should a dental practice do now?
1. Give the front desk a script that is true
Something like: “The report is about Delta Dental of Missouri, your insurance company. We have not been told your information is involved. If anyone contacts you about it asking for your Social Security number, call the number on your insurance card instead.” Skip lines like “our systems were not affected” unless someone has actually checked.
2. Warn the billing team about insurer-themed phishing
A payer in the headlines is a ready-made lure, whether or not any data was taken. Expect emails and calls about “claims updates,” portal password resets and new deposit details. Open the payer portal directly rather than through an email link, and confirm any banking change by calling a number you already have on file, never one from the message. Our list of common IT scams aimed at dental practices covers the patterns.
3. Tighten payer portal logins
Give each biller their own login, turn on multi-factor authentication where the portal offers it, and remove former staff. What we commonly see is one insurer login shared across a whole billing team, which we wrote about in the payer portal problem.
4. Keep a short file
Log patient calls, suspicious messages, and anything Delta Dental sends you, with dates. If a notice later names your patients, you will want that record for your HIPAA advisor.
For multi-location groups: one payer, every location
If your group centralizes billing, one compromised billing inbox or payer portal account can affect reimbursement across several locations at once. A shared portal login with no call-back rule for banking changes is the kind of shortcut that costs nothing until the day it does. Nobody budgets for the technology mistakes. They just pay for them twice.
Pick one owner for patient questions, use the same script at every location, and fold this example into your security awareness training.
Delta Dental of Missouri Data Breach FAQs
Did Delta Dental of Missouri have a data breach?
Not confirmed, as of November 6, 2026. The N0n ransomware group listed the company on its leak site on November 5, and the company told Becker’s Dental Review it is investigating with independent forensic specialists. Until the company or a regulator filing says what was taken, the list of stolen data is the attacker’s description.
What information does the attacker claim it took?
The listing claims member and subscriber records with full names, Social Security numbers, dates of birth, home addresses and dental treatment details, plus 48,528 email addresses, 17,913 phone numbers, and employer group and broker contacts. None of it has been independently verified, and the listing gives no count of members.
Is this the same as the Delta Dental MOVEit breach?
No. The 2023 MOVEit breach was reported by Delta Dental of California and its affiliates, and it exposed nearly 6.93 million people. Delta Dental of Missouri is not among the affiliates named in that notice.
Who is the N0n ransomware group?
A data extortion group that Ransomware.live first recorded in September 2026. It has listed more than 100 named organizations since, most often in transportation, technology, manufacturing and healthcare. Like any leak site listing, its description of stolen data is pressure on the named company until someone independent confirms it.
Is there a Delta Dental of Missouri class action?
A ClassAction.org page updated November 5 asks people who think their information was exposed to contact attorneys for an investigation. That page does not identify a filed complaint, and an investigation is not evidence that data was taken.
Do dental practices have to notify patients?
Not because their patients’ insurer was named on a leak site. If the plan has a breach of unsecured member data, notifying those members is the plan’s duty, or the employer plan’s for a self-funded group. A practice’s own duty depends on whether it discovers a breach of protected health information it is responsible for, which is a question for your HIPAA advisor. Our guide to dental data breach notification covers the deadlines.
The question to ask your billing team
If an email that looked exactly like your biggest payer asked your billing lead to sign in through a link and confirm your practice’s deposit details, what would happen? If the answer depends on who opens it, start there. If you want a second set of eyes on how your group handles it, the team at Medix Dental IT is happy to compare notes.
Posted in Dental Cybersecurity, News
