Dental Care Alliance Data Breach: What It Means for DSOs

A breach is not a one-time cost. It is a number that follows the business for years.

The Dental Care Alliance data breach ended in a settlement with a combined $3 million cap on claims and identity monitoring, and the settlement terms are a lesson every DSO leader and dental practice buyer should study. Dental Care Alliance is a dental support organization that, at the time of the breach, backed more than 320 affiliated practices across about 20 states. In fall 2020 the breach became one of the largest healthcare breaches disclosed that year. Its notice says unauthorized individuals accessed certain files on its network between September 18 and October 13, 2020. The count on the federal breach portal was later revised up to 1,723,375 people, and the class action settled two years later. For a DSO, and for anyone acquiring dental practices, this breach is a clear picture of how IT risk becomes financial risk.

What happened in the Dental Care Alliance breach

According to Dental Care Alliance’s notice, as reported by TechTarget’s HealthTech Security, it became aware of suspicious activity in its environment on October 11, 2020, and its investigation found that unauthorized individuals accessed certain files on its network between September 18 and October 13, 2020. It reported the breach to federal regulators, and its letters told patients there was no specific evidence their information was actually viewed. DCA’s notice does not describe how the attackers got in.

The count was originally reported at 1,004,304 individuals and later amended upward to 1,723,375, which is the revised count on the federal breach portal. Under the breach notification rules, the count reported to regulators can be updated as a review continues. Per its original notice to regulators, about 10% of the people covered by that notice had a bank account number potentially affected. The settlement subclass covered people whose Social Security numbers, financial accounts or driver’s license numbers may have been exposed. In 2022, Dental Care Alliance settled that class action in Georgia state court, with a combined $3 million cap on claims and identity monitoring and $850,000 in fees and costs payable separately.

Why IT risk is acquisition risk

Here is the part that matters most if you are building a group by acquisition. A DSO grows by adding practices, and every practice it adds either raises or lowers the security risk of the whole organization. A support organization that holds protected health information for hundreds of practices is a single high-value target, and one incident can reach a very large number of patients. The public records cited here do not tie Dental Care Alliance’s breach to an acquired practice or to how its systems were monitored. The case matters for its cost and its scale.

Now run the math a buyer runs. Start with the settlement’s maximum exposure, a $3 million cap on claims and identity monitoring plus $850,000 in fees and costs, then consider costs those amounts do not cover: defense counsel, notification, separately incurred monitoring, and reputational drag across every affiliated practice. That is what a breach can cost, and it is why IT due diligence before an acquisition is not a paperwork exercise. When you acquire a practice, you inherit its security posture, its unpatched systems, its old logins, and its retained data. If you do not assess that before the deal closes, you are buying someone else’s breach risk and pricing it at zero. A sophisticated buyer prices it correctly, and a weak security posture drags the valuation down.

What DSOs and acquirers should do now

For any group that grows by acquisition, security belongs in its financial discipline. Here is where that starts:

• Make IT security part of every acquisition checklist. Before a deal closes, assess the target’s endpoint protection, identity controls, patch status, backups, and retained data. Our guide on avoiding IT pitfalls in dental practice acquisitions walks through what to look for. Undiscovered risk can become your problem once the deal closes.
• Price the remediation into the offer. If diligence finds unpatched systems, no backups, or years of over-retained data, that is real money to fix, and it belongs in the valuation before you sign, not on your P&L after. A weak security posture is a negotiating point, and a strong one is worth paying up for.
• Onboard every acquired practice to your baseline fast. A newly bought office running its old, unassessed systems can be an easy way into the whole group, and every month it stays that way is inherited risk you are now carrying. Treat security integration as part of closing the deal, not a someday project.
• Reduce the data you inherit before it becomes your liability. An acquisition often comes with years of records the seller never needed to keep. Every one of them is exposure you now own. Removing data you no longer need, once retention and legal-hold requirements are met, shrinks both the breach count and the settlement math if it ever comes to that.
• Assume you inherit the seller’s incidents, not just their charts. If a target was quietly breached before you bought it, the cost, the notifications, and the lawsuits can land on your watch. Confirm the target’s incident history and current monitoring so you are not buying a breach that has not surfaced yet.

Security is part of the deal, not an afterthought

Dental Care Alliance’s case is an early example of a pattern: a support organization holds data for hundreds of practices, one incident reaches a very large number of patients, and the cost lands years later. The biggest dental data breaches on record include newer incidents like the DentaQuest breach and DSO incidents that reach patients of many practices at once.

For your group, treat security as a line item in the deal, not a cleanup task for after the ink dries. An acquired practice’s old IT becomes your problem once the deal closes, and a signed compliance form tells you nothing about whether its systems are actually defended. What protects the valuation is assessing risk before you buy, bringing every new location onto one baseline fast, and watching the shared systems that make a group both efficient and a target.

That is the work we do for the dental groups and DSOs we protect at Medix Dental IT. We assess IT risk before acquisitions, standardize an enterprise-grade security baseline across every location, and monitor the centralized systems that hold the most data. Before your next acquisition closes, do you know whether you are buying a clean environment or someone else’s breach risk? A cybersecurity assessment tells you before it is priced into your valuation the hard way. Prevention is always cheaper than panic.

Posted in Dental Cybersecurity, News