October 9th, 2026
Dental Ransomware Statistics 2026: What Leak Sites Show That Breach Notices Miss
Industry Research — Dental Cybersecurity, Research
Ransomware groups keep their own public scoreboard.
Ransomware and extortion groups listed 83 dental businesses on their leak sites in the 12 months from October 1, 2025, through September 30, 2026. Sixty-two were in the United States, about 5 a month, and 51 of those were dental practices or practice groups. For 35 of the 42 US practices listed through July, we found no matching filing on the HHS breach portal or the four state attorney general lists we searched. Each listing is a claim made by the group. We counted the businesses named on those sites, as recorded by the open tracker RansomLook, to build a set of dental ransomware statistics from the attackers’ side of the ledger.
That gap is the story. Trade-press breach counts come from notices and government filings. A leak-site count measures who the criminals say they reached, and the two lists overlap only in part.
| Dental ransomware leak-site listings, Oct 1, 2025 through Sep 30, 2026 | Count |
|---|---|
| Leak-site postings tracked, all sectors and countries | 10,832 |
| Postings that named a dental business | 87 |
| Dental businesses listed (repeat postings counted once) | 83 |
| Groups that listed at least one dental business | 36 |
| US dental businesses listed | 62 |
| US practices and practice groups among them (the rest were vendors, labs, a payer and a school) | 51 |
| US states with at least one listing | 22 |
| US dental businesses listed per month, on average | About 5 |
| US practices and groups listed through July 31, 2026 | 42 |
| Of those 42, practices with a filing we could match to the listed incident | 5 |
| Of those 42, practices whose name matches a filing we could not tie to the listed incident | 2 |
| Of those 42, practices with no filing we could find | 35 |
| Of those 35, practices in the four states whose lists we checked | 13 |
The filing gap: what we could find, and what we could not
A leak-site listing and a breach filing are separate public records, and only some filings are public at all. Under the HIPAA Breach Notification Rule, a covered entity must notify patients affected by a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after discovering it. Breaches involving 500 or more people go to HHS at the same time, and HHS posts them on its breach portal. Breaches involving fewer than 500 people are logged and reported to HHS within 60 days after the end of the calendar year in which they were discovered, and HHS does not post them.
State lists fill in some of the rest. Oregon, Washington and California publish the breach notices filed with their attorneys general. Texas requires notice to its attorney general as soon as practicable, and no later than 30 days after a business determines a breach occurred, when the breach involves at least 250 Texans. It posts those reports in a public database. Other states differ: some publish reports in places we did not search, and for some we found no public list at all.
We took the 42 US practices and groups listed through July 31, 2026, and checked each one against those five sources in early October, at least 60 days after the last of those listings. HHS reports appear on the portal after a delay, and the newest report in our export was submitted September 17. We matched legal names as well as brand names, because the name on a filing often differs from the name on the door. We found a filing we could match to the listed incident for 5 of the 42.
| Practice | Listed by | Public filing we found | Days from listing to HHS submission |
|---|---|---|---|
| Issaqueena Pediatric Dentistry (SC) | Interlock, Nov 25, 2025 | HHS portal, Feb 4, 2026 (listed at 501 people), plus its own notice | 71 |
| Pecan Tree Dental (TX) | Sinobi, Jan 12, 2026 | HHS portal, Jan 26, 2026 (13,300), Texas AG, Jan 30 | 14 |
| Arkansas Oral & Maxillofacial Surgeons (AR) | Pear, Apr 10, 2026 | HHS portal, Jul 31, 2026 (64,831) | 112 |
| Agave Dental Floresville, Allwyn Dental, Azle Smiles, Kashi Dental, Mysa Dental, Wilson Dental (TX) | The Gentlemen listed “Soniva Dental,” Jun 1, 2026 | Six HHS reports, Jul 24, 2026, and six Texas AG filings, Jul 28 (38,144 combined) | 53 |
| Hawaii Family Dental (HI) | Qilin, Jul 31, 2026 | HHS portal, Aug 21, 2026 (45,853), plus its own notice | 21 |
Two more listed practices share a name with an organization that filed an HHS report, but we could not tie either report to the listed incident, so we left both out of the table. In all five matched cases, the leak-site listing came before the HHS report was submitted. The gap ran from 14 to 112 days, with a median of 53. Some of these practices also posted their own notices, and our breach notice audit looks at whether patients and search engines can find a notice like that once it is up.
That leaves 35 listed practices with no filing we could find. Thirteen of them are in California, Texas, Oregon or Washington, where we checked a state list as well as the HHS portal, and none of the 13 appeared on either. Each of those state lists also has a size threshold, so a small breach can stay off them. The 35 is not evidence that 35 practices broke the rules. A breach involving fewer than 500 people never appears on the HHS portal. A practice may have filed in a state whose list we did not search, or posted a notice on its own site. A filing can sit under a legal name we could not connect to the brand. And a listing can be false or exaggerated: a group may claim data it never took. What the gap does show is narrower: for most listed practices, we found no matching record in the five public sources we searched.
The gap runs the other way too. The HHS portal shows 33 reports from organizations with dental names submitted between October 1, 2025, and mid-September 2026. Thirteen of them trace to seven businesses that also appear in the leak-site data. One came from a practice that shares its name with a listed practice in another state. The other 19 did not turn up in our name search of RansomLook’s data for the window. Thirty-two of the 33 were filed as hacking or IT incidents. Each list holds dental organizations our search did not find in the other.
What the leak sites show
The typical listing is a small practice. Of the 51 US practices and groups on the list, 35 had a single office, 13 had two or more, and for 3 we could not confirm a count. Specialty practices made up 16 listings: orthodontists, endodontists, periodontists, oral surgeons and pediatric dentists.
| Type of dental business | US listings |
|---|---|
| General practice, one office | 26 |
| Specialty practice, one office | 9 |
| General practice or group, two or more offices | 7 |
| Specialty practice, two or more offices | 6 |
| Practice, office count not confirmed (two general, one specialty) | 3 |
| Dental vendor (billing, equipment, materials, referrals) | 6 |
| Dental lab | 3 |
| Dental benefits payer | 1 |
| Dental assisting school | 1 |
| Total | 62 |
Eleven US listings were not practices. The six vendors were a billing company, four makers of dental equipment, materials or implants, and a patient-referral service. The payer was DentaQuest, whose incident we covered in our DentaQuest data breach post. A billing company or a payer can hold records for many practices at once, so one listing of that kind can reach far more patients than a single office.
The billing company was eAssist Dental Solutions, listed by a group called DireWolf on September 6, 2026. Two days later eAssist told customers it was investigating a potential information security incident. A later notice to former customers said the data potentially involved may have included usernames and passwords eAssist team members used to access customer systems. It did not confirm that any were taken. Our eAssist post tracks what has been confirmed since.
Which ransomware groups listed dental businesses
Twenty-eight different groups listed at least one US dental business, and 36 listed at least one dental business worldwide. Qilin, CRPxO and Sinobi together account for 23 of the 62 US listings. Across all countries Qilin listed 12 dental businesses, more than any other group in the data.
| Group | US dental businesses listed |
|---|---|
| Qilin | 8 |
| CRPxO | 8 |
| Sinobi | 7 |
| Akira | 3 |
| MyData | 3 |
| Nightspire | 3 |
| SafePay | 3 |
| 21 other groups, one or two each | 28 |
Some listings arrived in batches. CRPxO posted five US practices on July 8, 2026, and three more on August 12, all of them in California, Texas or Nevada. SafePay posted three practices in Oregon and Utah on December 17, 2025. Those three same-day batches account for 11 of the 62 US listings. The data shows the days the groups posted. It does not show when or how each practice was reached. One Oregon group practice was listed by SafePay in December and again by a second group, Bravox, about five weeks later.
Month by month
US listings ran at about five a month, between 2 and 8 in every month of the window. August 2026 was the high, driven by the second CRPxO batch. Twelve months is too short to call a trend. The steadiness is the useful part.
| Month first listed | US | All countries |
|---|---|---|
| Oct 2025 | 6 | 11 |
| Nov 2025 | 5 | 7 |
| Dec 2025 | 5 | 7 |
| Jan 2026 | 7 | 7 |
| Feb 2026 | 4 | 5 |
| Mar 2026 | 2 | 5 |
| Apr 2026 | 5 | 7 |
| May 2026 | 5 | 7 |
| Jun 2026 | 5 | 7 |
| Jul 2026 | 7 | 7 |
| Aug 2026 | 8 | 9 |
| Sep 2026 | 3 | 4 |
| Total | 62 | 83 |
Where the listed businesses are
California had the most listings with 11, followed by Texas with 7. Twenty-two states had at least one. Raw counts this small do not show which states carry more risk, so treat this table as a map of where listings landed.
| State | US listings |
|---|---|
| California | 11 |
| Texas | 7 |
| Florida | 4 |
| Massachusetts | 4 |
| Oklahoma | 4 |
| Utah | 4 |
| Colorado | 3 |
| Missouri | 3 |
| Oregon | 3 |
| Arkansas | 2 |
| New York | 2 |
| One each: AL, CT, HI, IA, NC, NJ, NV, OH, SC, TN, WA | 11 |
| State not determined | 4 |
What a listing proves, and what it does not
A leak-site listing is a claim made by a criminal group. RansomLook, the tracker behind this data, tells its own readers to “always treat a post as a claim until corroborated elsewhere.” Groups list victims to pressure them into paying, and some list organizations they never breached.
That is why this study counts listings and says “listed” and “claimed” throughout. It names a practice only when the practice, or a regulator filing in its name, has said something in public. One listed name in our data matches a Texas practice whose homepage says a social media post claiming it had a data breach “is completely false.” We counted the listing, because the count measures what the groups posted. We did not name the practice.
If your practice shows up on a leak site, the listing can be public before your investigation is finished, and what you say next is part of the response.
How we counted
Source. Leak-site postings come from RansomLook, an open-source tracker that publishes its data under a Creative Commons Attribution license. We pulled every posting RansomLook recorded for each month from October 2025 through September 2026: 10,832 postings across all sectors and countries. Our June 2026 dental cybersecurity data report draws on a different source, Medix’s own security monitoring of the practices we support.
Finding dental listings. We searched victim names for dental terms (dental, dentist, orthodontics, endodontics, periodontics, oral surgery, DDS, DMD, smile and others). Some groups post only a bare company name, so we also read each posting’s text for clues such as a website or city, and used it for identification only. No figure in this study comes from a group’s own description of what it took.
Verifying each one. Every candidate was checked against the business’s own website, the federal NPI registry or a company registry. We kept businesses whose main work is dentistry: practices, labs, payers and companies whose primary market is dental. We removed lookalikes, such as law firms, a school, an ENT clinic and an Italian farm-equipment maker, plus companies that serve dental and medical buyers equally. Repeat postings of the same business were counted once. Seven listings named a dental business we could not place. Four are US businesses with no confirmed state, shown as “State not determined.” Three have no confirmed country and count only in the worldwide total.
Checking filings. We exported the HHS breach portal’s open and archived cases in early October 2026 and pulled the Oregon, Washington, California and Texas attorney general lists at the same time. We did not visit any leak site or download any stolen data.
Limits. These are the listings one tracker recorded, found with one method. A name search misses practices listed under a name with no dental term in it, and no tracker sees every posting, so the real number of listings is likely higher. Some listings are false or mistaken, so not every one reflects a real breach. Source: RansomLook.
What this means for a practice or a dental group
I read this data as an operator, and four things stand out to me.
First, small practices are the norm on this list. Thirty-five of the 51 US practices had one office. If you are acquiring single-office practices, this is the profile you are buying, and each one arrives with whatever security it had on its own.
Second, look at the batches. The data only shows that one group posted several practices on the same day. That pattern raises a fair question: do those practices share an IT provider or a remote access tool? If you run a group, know every company that can reach into your network.
Third, vendors are on the list. A billing company, equipment makers and a referral service all showed up in 12 months, and the billing company’s later notice said the data potentially involved may have included credentials its staff used to reach customer systems. Ask every vendor that touches patient data how, and how fast, it would tell you about an incident, and which of your locations it can reach.
Fourth, the listing can come before your filing. In all five cases we could match, the leak-site listing appeared a median of 53 days before the HHS report was submitted. Decide now who drafts your notice, who answers patients’ calls and what your team does in the first hours of a ransomware attack. Our guide to the first steps after a breach is a good place to start.
One check anyone can run today: search your practice name, and the legal name you file under, on a public leak-site tracker such as RansomLook. If you are buying practices, run the same search on each target before you close, including former names and the vendors it uses. A clean search is one data point, not proof that nothing happened. I’ve sat on the buy side of $1B+ in dental practice M&A diligence. IT diligence is not a checkbox. It is risk pricing.
Posted in Dental Cybersecurity, Research
