October 12th, 2026
Biggest Dental Data Breach Lawsuits: What The Settlements Show
Industry Research — Dental Cybersecurity, Research
This study starts where most breach coverage stops: the courthouse.
The first dental data breach lawsuit in each case was filed a median of 7 days after patient notice letters began, in the seven cases where the records date both and the letters came first. In two more cases, a suit came before any letter went out. That is what we found in the filings behind 12 class settlements of dental data breach lawsuits first filed between January 2020 and September 2026, involving dental practices, dental groups, a dental insurer and benefits administrator, and a dental distributor. We found signed final approval orders for eight of the 12.
Every figure below comes from a settlement agreement, a court order, a motion or declaration filed in the case, or a regulator’s breach record. No figure comes from a law firm’s website or a news headline. In each agreement we read, the defendant denied wrongdoing, and a settlement is not a finding that anyone was at fault.
| Measure (12 dental data breach class settlements, first suits filed January 2020 through September 2026) | Result |
|---|---|
| Settlements in this snapshot | 12 |
| With a signed final approval order we could find | 8 |
| Preliminary approval only, or final approval not confirmed in the records we reviewed | 4 |
| Median days from first patient notice letters to first lawsuit, in the 7 cases where the records date both and the letters came first | 7 |
| Of those 7, first lawsuit filed within 3 weeks of the letters | 6 |
| Cases where a lawsuit was filed before notice letters went out | 2 |
| Gross settlement fund per class member, 7 final settlements with a cash fund | $1.39 to $17.42 (median $5.57) |
| Fee awards as a share of the cash fund, same 7 (two awards include costs; rounded to whole percents) | About 32% to 34% in six, 51% in one |
| Class members who filed a claim, the 5 of those 7 final settlements that reported a count | 1.1% to 5.4% |
| Months from first lawsuit to final approval, 6 cases with a first-suit date or month and a dated final order | About 14 to 27 |
How fast do dental data breach lawsuits follow notice letters?
Under the HIPAA Breach Notification Rule, a covered entity such as a dental practice must notify the people affected by a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after discovering it, with a narrow exception for law enforcement delays. Breaches involving 500 or more people must be reported to HHS at the same time, and HHS posts them on its public breach portal. Many states publish the notices filed with their attorneys general too.
Where the letters came first, the first suits clustered tightly. Hapy Bear Surgery Center, a pediatric dental practice in Tulare, California, was sued 4 days after its letters began.
| Defendant | Patient notice letters began | First lawsuit | Days |
|---|---|---|---|
| Hapy Bear Surgery Center | Apr 11, 2024 | Apr 15, 2024 | 4 |
| First Choice Dental | About July 12, 2024 | July 17, 2024 | About 5 |
| Great Expressions Dental Centers | May 12, 2023 | May 18, 2023 | 6 |
| Community Dental Care | Mar 28, 2025 | Apr 4, 2025 | 7 |
| MCNA Dental | May 26, 2023 | June 5, 2023 | 10 |
| Dental Group of Amarillo | May 9, 2024 | May 29, 2024 | 20 |
| Smile Brands | June 25, 2021 | Oct 28, 2021 | 125 |
| Minnesota Orthodontics | October 2025 | June 2, 2025 | Filed about 4 months before the letters |
| Absolute Dental | Aug 26, 2025 (Oregon AG record: notice sent) | June 2025 (lead federal case filed June 4) | Suits began about 2 to 3 months before notice was sent |
Smile Brands is the outlier at 125 days. In two other cases, a lawsuit was filed before any patient letter went out. Minnesota Orthodontics posted a notice on its website right after discovering the breach, reported it to HHS on May 5, 2025, and faced a complaint on June 2, four weeks later. Its settlement agreement says formal letters went out that October. Absolute Dental’s breach report was submitted to HHS on May 2, 2025. Suits began in June, with the lead federal case filed June 4, and notice went out on August 26, the date on the Oregon, California and Washington attorney general records.
First Choice Dental and Dental Group of Amarillo submitted reports to HHS months before their letters went out, and their first suits followed the mailing dates within days or weeks. HHS portal dates are submission dates, so these records do not show when each report became public or what prompted each filing. They do show how short the window can be once letters go out.
How large are dental data breach settlement funds per class member?
Seven settlements have a signed final approval order and a cash fund. The funds ran from $440,000 at ProSmile, which court filings describe as a dental services organization in the Mid-Atlantic, to $5 million at Smile Brands. Divided by the class size stated in each court record, the gross fund came to $1.39 to $17.42 per class member, with a median of $5.57, before fees and administration. This is not an individual payout amount.
| Defendant | Settlement fund | Class size | Gross fund per class member |
|---|---|---|---|
| Great Expressions Dental Centers | $2,700,000 | 1,945,788 | $1.39 |
| Absolute Dental | $3,300,000 | 1,223,437 | $2.70 |
| Smile Brands | $5,000,000 | 1,515,078 | $3.30 |
| Hapy Bear Surgery Center (cash fund) | $607,500 | 109,161 | $5.57 |
| Dental Group of Amarillo | $1,000,000 | about 109,684 | $9.12 |
| ProSmile | $440,000 | 39,455 | $11.15 |
| Henry Schein | $2,900,000 | 166,432 | $17.42 |
The three settlements with classes over one million people had the lowest gross fund per class member: $1.39, $2.70 and $3.30. The four with classes between about 39,000 and 166,000 came to $5.57 to $17.42. Seven cases are too few to call that a rule.
The class is not always the same group as the people notified. Absolute Dental reported 1,223,635 people to HHS and the Oregon attorney general, and its settlement class is 1,223,437. Smile Brands reported 2,592,494 to HHS, and its court record puts the class at 1,515,078. We used the class size from the court record, because that is the group the fund covers.
Where the money went: fees and claims
In six of the seven funded settlements, the court’s fee award came to about 32% to 34% of the cash fund, rounded to whole percents. Two of those awards, at Great Expressions and Absolute Dental, cover fees and costs together. Hapy Bear is the exception. Its $312,500 fee is 51% of the $607,500 cash fund, and a third of the $937,500 total value its agreement states, a figure that includes security measures the practice estimated at more than $330,000. The base changes the picture: the Smile Brands court described its $1.6 million fee as 12.9% of the class’s recovery, measured against the plaintiffs’ valuation, which counted credit monitoring and more than $4.5 million in remedial measures.
| Defendant | Fees awarded | Share of cash fund | Claims filed (share of class) |
|---|---|---|---|
| Smile Brands | $1,600,000 | 32% | 26,949 (1.8%) |
| Absolute Dental | $1,100,000 | 33% | 13,816 (1.1%) |
| Henry Schein | $966,570 | 33% | 8,969 (5.4%) |
| Great Expressions Dental Centers | $925,000 | 34% | Not reported in the filings we read |
| Dental Group of Amarillo | $333,333.33 | 33% | 2,225 (2.0%) |
| Hapy Bear Surgery Center | $312,500 | 51% | Not reported in the filings we read |
| ProSmile | $146,666.67 | 33% | 1,194 (3.0%) |
Few class members filed a claim. Of the seven final settlements with a cash fund, five report a claim count in their final approval filings, and in those, 1.1% to 5.4% of the class had filed. After fees, administration, service awards and any other deductions an agreement sets, the balance pays eligible claims under that agreement’s allocation rules, and money left over follows its provisions for leftover funds.
Five more settlements are not in the fund and fee tables above. For four, we could not confirm final approval in the records we reviewed. The fifth, Dental Care Alliance, reached final approval in 2022 but has no fixed fund to divide: it pays claims as submitted up to a cap, with fees paid on top.
| Defendant | Settlement structure | Where it stands in the court record |
|---|---|---|
| Dental Care Alliance | Claims and identity monitoring paid as submitted, capped at $3,000,000 in total. $850,000 for fees and costs paid separately. | Final approval, Sept 1, 2022 (Georgia state court) |
| MCNA Dental | The proposed agreement caps cash for documented losses at $250,000 in total and offers two years of medical data monitoring to any class member if it takes effect. Class counsel may ask for up to $6.4 million in fees, paid separately. | Preliminary approval July 14, 2026. Final hearing set for Nov 16, 2026. |
| First Choice Dental | The proposed agreement sets a $1,225,000 cap covering cash payments, fees, administration and $225,000 of security work, with three years of credit monitoring offered on top of the cash options. | Preliminary approval Sept 30, 2025. Final hearing was set for Jan 12, 2026. Final approval not confirmed in the records we reviewed. |
| Community Dental Care | If approved, the agreement would pay eligible claims as submitted, with no stated total cap. Class counsel will apply for up to $400,000 in fees and costs, paid separately. | Final hearing set for Nov 23, 2026. |
| Minnesota Orthodontics | The proposed agreement offers credit monitoring or a $25 cash payment, reduced pro rata if claims exceed a $50,000 total. Class counsel asked for up to $135,000 in fees and costs, paid separately. | Preliminary approval Feb 10, 2026. Final hearing was set for June 5, 2026. Final approval not confirmed: the order on the settlement site is unsigned. |
Preliminary approval and final approval are different orders
A court signs off on a class settlement twice. Preliminary approval lets the parties send notice and open the claims period. Final approval comes after a hearing, once class members have had the chance to object or opt out. In the agreements we read, payments go out only after final approval. In the six cases we could date at both ends, final approval came about 14 to 27 months after the first suit, from Absolute Dental at the short end to Smile Brands at the long end. For a buyer, that is how long one of these settlements can take to reach final approval.
MCNA Dental shows the gap. Its breach was reported to the Maine and Oregon attorneys general as affecting 8,923,662 people, and its settlement has preliminary approval only. The proposed $250,000 cap on cash for documented losses works out to under 3 cents per person notified, though any class member could also enroll in medical data monitoring if the settlement takes effect. Our MCNA data breach post covers the incident itself.
The settlement websites were not a safe guide to which stage a case had reached. We counted a settlement as final only when we found a final order signed by the judge. The document labeled as the final order on one site belonged to a different case. On another site, the posted final order was the unsigned draft the parties submitted. And two signed final orders still carried the word “proposed” in their titles, which is common court practice but easy to misread. For Minnesota Orthodontics and First Choice Dental, the hearing dates have passed and we could not confirm a signed final order, so we do not count either one as final.
When a vendor is in the case
These cases also show how companies beyond the dental practice can end up in breach litigation. Absolute Dental’s lawsuit also named Judge Consulting, an IT consulting firm that worked with the practice. Absolute Dental settled for $3.3 million, and the court’s final order says the settlement covers Absolute Dental only and does not include the consulting firm, which remained a defendant. Our Absolute Dental breach post has the background.
The other two defendants are not dental offices at all. Henry Schein, which sells supplies and practice software to dental offices, settled its own class action for $2.9 million. MCNA operated as a dental insurer in Florida and a third-party administrator in certain other states, and its proposed settlement also covers MCNA Insurance Company and Healthplex.
Those cases have reached proposed or final settlements. Three lawsuits naming eAssist, a dental billing company majority owned by Henry Schein, were filed in federal court in Utah between September 14 and 24, 2026, after the security incident covered in our eAssist data breach post.
How we built this snapshot
What counts. A case is in this snapshot if it is a class action over a data breach at a dental practice, dental group, dental benefits company or a company whose main market is dental, if the first suit was filed from January 2020 through September 2026, and if it reached a proposed or final class settlement. Twelve cases qualified: Absolute Dental, Community Dental Care, Dental Care Alliance, Dental Group of Amarillo, First Choice Dental, Great Expressions Dental Centers, Hapy Bear Surgery Center, Henry Schein, MCNA Dental, Minnesota Orthodontics, ProSmile and Smile Brands. Henry Schein sells to medical buyers as well as dental offices. We kept it, and label it as a distributor, because dental offices are a core customer group for it.
Sources. For each case we reviewed the available settlement agreement, approval orders, fee order, motions and administrator declarations, mostly from the official settlement websites, such as those for Community Dental Care, ProSmile and Dental Group of Amarillo. Where a site was offline, we read archived copies of its court documents. Notice dates come from the settlement filings, the HHS breach portal and state attorney general breach lists. Where letters went out in waves, we used the date the first wave began, and First Choice’s agreement dates its letters “on or around” July 12, 2024.
What we left out. Cases that have not settled are not in the count. That includes newer suits such as the consolidated litigation over the DentaQuest data breach. We also left out class actions over tracking pixels on dental websites. Aspen Dental settled one of those in Illinois state court in 2025, for up to about $18.5 million, and it is sometimes described online as a data breach. That case concerns allegations that information was shared with third parties through tracking tools on a website, which is a different kind of claim.
Limits. Our docket search ran mainly through CourtListener, which covers federal courts. State court cases appear here only when a settlement website or filing pointed us to them. So this is a snapshot of the dental data breach settlements we could document, and others likely exist.
What these cases mean for a dental group or a buyer
Reading these court records with an M&A and growth lens, three things stand out to me.
First, in these cases the lawsuits came fast. Four of these suits were on file within a week of the patient letters, and two came before the letters went out. Your notification plan and your response to a lawsuit need to be ready before a breach, and our guide to dental data breach notification covers the notice side.
Second, the settlement is one line in the cost. The cash funds here ran from $440,000 to $5 million, and in six of the seven, the fee award came to about a third of the fund. Your own defense counsel, forensics, notification and lost production come on top of that. Our breakdown of the real cost of a dental data breach covers the rest. Read what your cyber liability insurance pays for claims like these, and what you attested to about your security controls when you bought it. The same questions belong in any purchase, and our guide to IT pitfalls in dental practice acquisitions has a section on a seller’s breach history and cyber insurance.
Third, companies beyond the practice end up in court too. An IT consultant was named alongside one practice, and a distributor and a dental insurer were sued over their own breaches. Know which vendors hold your patient data, what your contracts say about who pays after an incident, and whether those vendors carry their own coverage. Ask them for their incident history in writing too, since our dental vendor data breach research found vendor incidents we couldn’t tie to any HHS entry.
Six of the companies in this snapshot also appear in our list of the biggest dental data breaches, and a breach like any of them can follow a practice into a sale. If you are buying practices, ask each target whether it has had a breach, whether anyone sued and whether a settlement is still waiting on final approval. Then get the documents: the settlement agreement, the signed orders, and any security work or payments the target still owes under them. I’ve sat on the buy side of $1B+ in dental practice M&A diligence. Ignoring IT diligence does not save money. It just moves the cost to after the deal closes.
Posted in Dental Cybersecurity, Research
