October 16th, 2026
Dental Vendor Data Breaches We Couldn’t Find on the HHS List: MMG Fusion and Others
Industry Research — Dental Cybersecurity, DSO
A dental software vendor’s breach reached about 15 million people, and we couldn’t find it on the federal breach list.
In March 2026, the HHS Office for Civil Rights announced a settlement with MMG Fusion, a company that sold software to dental practices, over a 2020 breach affecting about 15 million people. That’s about a third of the people counted across all 196 dental breach reports on the HHS list since 2019, added together without removing overlaps. At Medix Dental IT, we searched all 8,019 reports on the list and found nothing we could connect to it. To see how dental vendor data breaches show up in the federal record, we traced how 184 of those 196 dental reports happened, then ran the same test on a random sample of other healthcare reports.
So does the HHS list capture dental vendor breaches? Not reliably, based on what we found. We couldn’t connect any entry to the MMG Fusion breach of about 15 million people, or to two 2019 attacks on dental IT providers. Separately, 17 of the 184 dental reports we could trace (9.2%) reached the list as vendor, plan or software breaches. That figure measures what reached the list in a form we could trace, and the cases below show why it can’t measure how often vendors are the way in. Vendor incidents can be hard to find on the list. Some produce a run of separate practice filings that never name the vendor. Some leave no entry we could connect to the incident at all.
| What the federal record shows | Finding |
|---|---|
| Dental software vendor breach of about 15 million people (MMG Fusion, December 2020) | No HHS entry we could connect to it |
| Dental breach reports on the HHS list in the window | 196 (we traced how 184 happened) |
| Traced dental reports that reached the list as vendor, plan or software-flaw breaches | 9.2% (17 of 184) |
| Share of traced healthcare-sample reports meeting the same definition (what reached the list in a form we could trace) | 35.4% (52 of 147) |
| Reports where HHS’s “business associate present” field didn’t match our classification | 22 of 184 dental, 8 of 147 healthcare |
A note on where I sit. I’m the CEO of Medix Dental IT. We sell dental IT and security services, which puts us in the same category as several vendors in this study. Apply the questions in the checklist below to us too.
MMG Fusion: 15 million people, no portal entry we could find
OCR’s resolution agreement describes MMG Fusion as “a software company that focuses on helping oral healthcare professionals to market, manage and grow their practices.” In December 2020, an intruder got into MMG’s systems and reached about 15 million people’s names, contact details, birth dates and appointment times, according to the HHS Office for Civil Rights settlement announced March 5, 2026.
OCR opened its investigation in March 2023 after a complaint about an unreported incident. Among the potential violations it listed was “failing to notify covered entities affected by the incident of the breach.” Under the agreement, signed in June 2025, MMG paid $10,000 and accepted a corrective action plan that OCR will monitor for three years. The agreement says it is not an admission of liability by MMG. It also requires MMG, once HHS approves its breach assessment, to notify affected covered entities “to the extent possible,” so practice filings tied to the incident may still come.
No report on the list names MMG Fusion. We also looked for anything that could stand in for it. From December 2020 through September 2026, dental organizations filed 150 reports. The ones that went through an outside vendor add up to about 1.25 million people, and none traces to MMG. In that period, the only dental report listing 15 million or more people is DentaQuest’s 2026 report. Its notice filed with the Washington attorney general describes a separate social-engineering incident on DentaQuest’s own network.
If MMG’s customers reported, it could be in reports too small for the public list, in the 12 dental reports we couldn’t trace, under organization names with no dental word, or in descriptions we couldn’t connect to MMG. We include MMG in our list of the biggest dental data breaches on record. On the federal list, it doesn’t appear under the vendor’s name.
The 2019 dental IT provider ransomware attacks we couldn’t find either
On August 26, 2019, ransomware was deployed on the remote management software used by DDS Safe, a dental backup service endorsed by the Wisconsin Dental Association. Three days later, the association told members that PerCSoft, “the IT vendor for DDS Safe,” had moved to contain it and that “roughly 400 practices around the country lost access to electronic files.” About three weeks after the attack, DDS Safe said the number of affected practices was “much lower” than first thought, and that fewer than 100 of them were DDS Safe clients, with the rest contracting with PerCSoft directly. Those statements are collected in the DDS Safe and Wisconsin Dental Association updates.
Three months later, ransomware spread through Complete Technology Solutions, a Colorado IT provider. It disrupted more than 100 dental practices, and the company reportedly declined an initial $700,000 ransom demand, as KrebsOnSecurity reported in December 2019. I was quoted in that story, because I’d been talking with practices that were sidelined by it.
| Vendor | What it did for practices | Practices reported | HHS entry we could tie to it |
|---|---|---|---|
| PerCSoft, IT vendor for DDS Safe, August 2019 | Remote management behind a cloud backup service | Roughly 400 at first, later “much lower” | None found |
| Complete Technology Solutions, November 2019 | Managed IT, security, backup and phones | More than 100 | None found |
We searched every report on the portal for both vendors’ names. Of the 24 dental reports filed from July 2019 through June 2020, none named either company or described an incident at an outside vendor or IT provider. We also checked the Washington, Oregon and California attorney general breach lists for those months and found no matching dental filing. We didn’t check other states.
For DDS Safe there is one documented reason. In September 2019, DDS Safe told its clients that, based on the forensic investigation, it did not believe practice data was compromised beyond being encrypted. It said it had run the four-factor risk assessment HIPAA describes and “concluded that the security incident does not amount to a data breach.” It said it would provide information on that assessment so each practice could conduct its own. HHS guidance says that when ransomware encrypts patient data, a breach is presumed unless the organization can show “a low probability that the PHI has been compromised.” An assessment like that is one way an attack that locked practices out of their files can stay off the breach list.
For Complete Technology Solutions, and for the practices that worked with PerCSoft directly, we found no public record of how the incidents were assessed. Practices may have judged them not reportable. They may have filed under their own names without describing the vendor. Some may have had fewer than 500 people affected, which keeps a report off the public list even though it still goes to HHS.
What the federal list does record
Here’s what the list shows when you read every dental report and trace how each one happened, where the record allows it. We used OCR’s own description where one existed. Where it didn’t, we used the organization’s notice, an attorney general filing, a court record or, for a few reports, trade coverage of the notice.
| How the breach happened | Dental reports | Dental incidents |
|---|---|---|
| Breached organization’s own systems, staff, devices or mail | 151 | 142 |
| Through an outside vendor | 10 | 7 |
| A dental plan or vendor breached while serving others | 6 | 6 |
| Third-party software flaw on the organization’s own systems | 1 | 1 |
| DSO management company holding the practices’ data | 16 | 5 |
| Vendor, plan or software share, dental | 9.2% | 8.7% |
| Same share, healthcare comparison sample | 35.4% | n/a |
Of the dental reports we could trace on the HHS list, 17 of 184 met our vendor, plan or software definition. In the healthcare comparison sample, 52 of 147 did. Because that figure comes from a sample, its 95% range runs from about 28% to 43%. The dental share stays under that range even if all 12 reports we couldn’t trace turned out to be vendor-related.
That gap can’t measure how often vendors are the way in, as the cases above show. The two groups were also built differently. Every healthcare report in the sample had an OCR description, while some dental reports were traced through notices. By count of people affected, the ten outside-vendor reports account for about 1.25 million of the 45.2 million people on the dental reports, under 3%. That narrow category leaves out the plan, vendor-as-business-associate and software-flaw reports.
The “business associate present” field needs care too. On the dental reports we traced, it didn’t match our classification of how the breach happened 22 times out of 184. Sometimes it said yes where we found the office’s own incident. Sometimes it said no where we found a vendor, plan, management-company or software route, including a few where the filer was itself the vendor. On the healthcare sample it didn’t match 8 times out of 147, all of them a no where we found a business associate involved. Counting dental vendor breaches from that field alone gives a different number than reading the reports.
One incident, many filings: what this means for DSOs
For a dental group, the more useful pattern is what happens when one incident touches many locations. When a group’s practices operate as separate covered entities, one event can produce a stack of reports, and the vendor or parent may never be named.
| One incident | HHS reports | People affected | What the list shows |
|---|---|---|---|
| Email phishing at North American Dental Management, which held data for Professional Dental Alliance practices (2021) | 12 | 174,076 | Practice network names, all filed the same day. One filer carries the parent group’s initials. The management company isn’t named. |
| Attack on Soniva Dental Care locations in Texas, discovered May 2026 | 7 | 41,424 | Six location names filed the same day, one more in September. Soniva isn’t named. |
| Email phishing at an unnamed vendor serving practices in North Carolina and Virginia (2025) | 4 | 13,678 | Practice names filed the same day. The vendor isn’t named. |
Three incidents produced 23 separate reports on the HHS list. We grouped them using the organizations’ own notices.
The same concentration shows up in the counts of people affected. This comparison covers DSO-affiliated practices and independent practice organizations across all reports in the window, and leaves out dental plans, vendors and schools. 22 incidents at DSOs and their affiliated practices involved about 8.8 million people. 130 incidents at independent practices and doctor-owned groups involved about 2.3 million. The median DSO report covered about 10,600 people, against about 4,100 for an independent practice. Shared systems are part of how a group scales, and they can also let one incident reach several locations at once.
I’ve walked into organizations with 30, 40, even 50 locations where every single practice runs differently. Different PMS. Different security tools. Different vendors. Every extra MSP adds another security baseline you have to enforce. The answer I’d want is one standard, enforced at every location, with vendor access split by role, logged and reviewed, so no single account opens every office.
Vendor access deserves its own review
Several of the vendor cases in this study involve access a vendor held into many practices at once. PerCSoft ran the remote management software behind DDS Safe’s backups. Complete Technology Solutions managed its clients’ networks. At Absolute Dental, a Nevada group whose breach reached 1,223,635 people on the HHS list, the notice says the access came “through an account associated with Absolute Dental’s third-party managed services provider.” We covered what that notice does and doesn’t say in our Absolute Dental breach analysis.
When I spoke with KrebsOnSecurity in 2019, I said a lot of practices are “forced into a price point on what they’re willing to spend,” and that the priority is how fast a provider solves problems, “not necessarily the security stuff behind the scenes until it really matters.” I still see that. It’s part of why the one IT person or one IT company who holds every password can become a single point of failure for a whole group.
Why vendor incidents are hard to find on the list
There are four possible reasons, in no particular order.
- Judged not reportable: DDS Safe documented a four-factor HIPAA assessment for its clients in 2019.
- Practices not told: OCR listed this among MMG Fusion’s potential violations.
- Filed under practice names: a search for the vendor or parent may miss the reports.
- Under 500 per practice: the report goes to HHS but not onto the public list.
Public records can’t tell these apart for most incidents. Our own audit of whether dental breach notices can be found online hit the same wall from the other direction. Even when a notice exists, it can be hard to find. Our dental ransomware statistics came at it a third way, looking for public breach filings from dental businesses named on ransomware leak sites. Our count of dental data breaches by state found nine states with no dental provider report on the list since 2009. A zero there doesn’t mean nothing happened.
How to assess dental vendor risk beyond the HHS list
The HHS list is a useful screening tool, but a vendor’s absence from it tells you very little. Here are the six things I’d check with every vendor that holds access to patient data or practice systems, Medix included.
- Incident history in writing. Ask for every security incident in the last five years, including the ones the vendor assessed as not reportable. The DDS Safe case shows why that last part matters.
- A notice clock in the BAA. OCR’s director said it plainly in the MMG Fusion announcement: business associates must notify affected covered entities “without unreasonable delay and within 60 calendar days of discovery.” Your contract can ask for faster notice, and it can start the clock at a security incident instead of a confirmed breach.
- How vendor access works. List every vendor with standing access to your network or your Microsoft 365 tenant. For each, know how access is authenticated, logged and revoked, and which sessions need your approval.
- Separately protected backups. Confirm that a compromise of the accounts that run your systems can’t erase every recovery copy, and test a restore.
- Where your data goes. Know which vendors copy patient data and where it ends up. We walked through that in mapping where your vendors copy patient data.
- Search by every name. Search the HHS list for your own legal entity names, your vendors’ legal names and any parent company, and treat a clean result as one data point.
For a group, the step that matters most is doing this once, centrally, for every location. Check whether vendors approved years ago by a single office still hold access nobody needs.
Here’s the question I’d leave with any leadership team. If your most connected vendor had a bad night, how would you find out, and how long would it take?
How we counted
We downloaded both tabs of the HHS Office for Civil Rights breach portal on October 13, 2026: 7,266 archived reports and 753 still under investigation, 8,019 in all. The window is reports submitted from January 1, 2019, through September 30, 2026, which is 5,468 reports.
We found dental reports by dental terms in the organization’s name or OCR’s description, plus a list of dental vendors, plans and DSOs, then removed false matches by hand. That left 196. For each one we decided how the breach happened from OCR’s description or, where none was usable, from the organization’s own notice, an attorney general filing, a court record or, in a few cases, trade coverage of the notice. We couldn’t trace 12. Reports from one event were grouped into a single incident, which gives 161 incidents among the 184 traced reports.
For the healthcare comparison we drew a random sample of 150 non-dental reports with OCR descriptions from the same window, applied the same rules, and set aside 3 that couldn’t be used. In both groups, management companies that hold data for affiliated practices are left out of the vendor count and kept in the totals. The 95% range for the sample uses a standard normal approximation, and it doesn’t account for the difference in how the two groups were traced or for incidents that were never reported.
The limits, in plain terms. The public list only includes breaches of 500 or more people. Our name matching misses organizations with no dental word in their legal name. We found and added five of those, so there are likely more. Four OCR descriptions were attached to the wrong organization, and we didn’t use them. The 2019 practice counts are the estimates reported at the time, and nobody published an audited total. Not finding a portal entry doesn’t establish that anyone broke a reporting rule. The MMG Fusion section reports OCR’s allegations as allegations.
Posted in Dental Cybersecurity, DSO
