October 27th, 2026
iDentalSoft Data Breach: What It Means for Dental Practices
Industry Research — Dental Cybersecurity, News
A ransomware group put a cloud dental software company on its leak site in early October, and practices on that software now have questions to answer.
On October 9, 2026, ransomware tracker Ransomware.live recorded a Termite leak site listing naming iDentalSoft, a cloud-based dental practice management software company. As of October 20, we have found no incident notice on iDentalSoft’s website and no entry on the California or Oregon attorney general breach lists. So far, the iDentalSoft data breach is a claim made by the attacker.
The short answer: we have found no public confirmation of a breach from iDentalSoft. Termite claims it took about 15 GB of data, including patient records, ID documents, and what it calls integration-layer API keys and system credentials. None of it is independently verified. If your practice runs on iDentalSoft, start now rather than waiting on the vendor: list every service connected to it, plan credential changes with each of those vendors, review who can sign in, find your business associate agreement, and ask iDentalSoft in writing what it knows.
What is actually known about the iDentalSoft breach claim
The listing exists. Ransomware.live, which indexes leak sites, recorded the posting at 12:59 UTC on October 9.
A lawsuit was filed. On October 13, Cronan v. iDentalSoft, Inc. was filed in federal court in Northern California. The federal docket for case 5:26-cv-11828 shows the complaint and only procedural entries since. The complaint is not on the free public docket, so we cannot say what it alleges or whether it concerns this listing.
What we have not found: a public notice from iDentalSoft, or an entry on the California or Oregon attorney general breach lists. Breaches affecting 500 or more people must be reported to the federal breach portal without unreasonable delay and within 60 days of discovery. No discovery date is public here, so an absence there would mean little yet. Our study of dental businesses named on ransomware leak sites checks which of them later filed a public breach report.
What is being repeated, checked
“iDentalSoft is based in Brazil.” Wrong. The tracker tags the listing with Brazil, and at least one AI search answer repeats it. iDentalSoft’s own website gives its address as Milpitas, California.
“Termite encrypted iDentalSoft’s data.” Unverified. Some AI answers say so, but the legible text of the listing describes data the group says it extracted and does not say the group encrypted iDentalSoft’s systems.
The 2019 attack is a different incident. Searches for iDentalSoft ransomware also return coverage of the August 2019 attack on PerCSoft and The Digital Dental Record, which hit a backup service for dental offices. It is a separate incident.
What the Termite listing claims was taken
Parts of the listing’s text are cut off on the page, so we quote only phrases that are legible. Every line is the attacker’s claim, and the listing gives no count of practices or patients.
| What the listing says it holds | Why it matters to a practice |
|---|---|
| “Medical integration layer data including API keys and system credentials” | If real and still valid, credentials like these could reach services connected to the platform |
| “Clinical medical assessment records and treatment history” | Chart data, which is protected health information under HIPAA |
| “Patient document repository including signed consent forms and identification” | Scanned IDs and signed forms, raw material for identity fraud |
| “Audio recordings of consultation sessions and diagnostic appointments” | Recorded conversations with patients |
| “Database dump files including full schema and patient record tables” | The database structure plus patient record tables, though not a record count |
The “15 GB of data” total comes only from the listing’s text. The tracker’s own data-size field for this record is empty.
Why a cloud PMS is a different kind of vendor breach
A cloud practice management system sits at the center of a practice, and it connects to everything else. iDentalSoft’s integrations page describes “open API support,” with links to payment processors, online booking and an AI imaging service. The iDentalSoft Bridge connects X-ray sensors and intraoral cameras, and the platform supports e-prescribing, including controlled substances. Compared with the eAssist billing incident in September, a PMS sits one step closer to the chart.
That is why the credential claim matters most. Depending on its scope and whether it still works, an integration credential can reach the services that trust it, and what we commonly see is that few practices can list every system their PMS talks to.
What should a practice on iDentalSoft do now?
None of these steps waits on the listing being proven. Ask and inventory first, then change things in order.
1. Ask iDentalSoft in writing
Ask whether your data or credentials were on any affected system, what iDentalSoft has rotated, what it wants you to rotate, and when its next update comes. If it cannot give a date for a full answer, write that down.
2. Change integration credentials and staff passwords, in order
First confirm which integration keys and tokens are yours to change and which iDentalSoft manages for you. Change yours, coordinating with each vendor first so payments or booking don’t break mid-morning. Reset staff passwords, sign out active sessions, and turn on multi-factor authentication. If prescribers e-prescribe controlled substances, ask that vendor whether their credentials should be reissued.
3. Review who can sign in
Remove former staff and old vendor accounts, check any audit log for bulk exports, and confirm every workstation running the Bridge is patched.
4. Pull the business associate agreement
Under 45 CFR 164.410, a business associate must notify the covered entity, meaning your practice, of a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after discovery. Your business associate agreement may set a shorter window.
5. Brief the front desk, and keep a file
If patient details circulate, one likely symptom is a convincing phone call. Knowing real details does not make a caller legitimate. Keep every vendor notice, question, answer and change date for your HIPAA advisor.
For multi-location groups: one platform, one dependency
Standardizing every location on one PMS is the right call. It also means a vendor incident is rarely one office’s problem. A platform problem does not politely hit one office at a time. A group on iDentalSoft, which markets itself to DSOs, needs one owner for vendor communication, one credential plan across every location, and a downtime procedure in each office.
The same applies before a deal. If you are acquiring a practice on iDentalSoft, ask in diligence whether it received a notice, what it changed, and how it documented its breach assessment. IT diligence is not a checkbox, it’s risk pricing, and an unresolved vendor breach claim is work a buyer will account for. If nobody has run a vendor risk assessment on your PMS, start with our look at which dental vendors hold patient data.
iDentalSoft Data Breach FAQs
Has iDentalSoft confirmed a data breach?
Not publicly, as of October 20, 2026. The public record we found is the Termite listing recorded on October 9, plus a lawsuit filed October 13 whose complaint is not on the free public docket, so its subject is unconfirmed. We have not seen any customer letters from iDentalSoft, so practices on the platform should ask the company in writing whether their data was involved.
When did the iDentalSoft breach happen?
Neither the listing nor any public statement we found says. The tracker recorded the listing on October 9, 2026, and leak site listings can come days or weeks after an intrusion. Treat October 9 as the date the tracker recorded the claim, not the date of a breach.
Who is the Termite ransomware group?
A group that surfaced in late 2024 and claimed the attack on supply chain software company Blue Yonder that year. A listing on its leak site is pressure on the named company, and its description of the data is marketing until someone independent confirms it.
Should we stop using iDentalSoft?
We are not recommending that. A leak site listing is not a confirmed breach, and moving a practice management system mid-incident brings its own risks, from data conversion to downtime. The useful work now is getting written answers, keeping the schedule and billing running, and tightening the access you control.
Do we have to notify patients?
That depends on facts the public record does not show yet, so it belongs with your HIPAA advisor or counsel. If iDentalSoft is your business associate, it must notify you of a breach of unsecured protected health information it holds for you, and your own duty to patients does not disappear because the incident happened on its systems. Our guide to dental data breach notification walks through the deadlines.
The question to ask your team this week
If your practice management vendor called tomorrow and said its integration keys were stolen, could you list every system those keys open, and who would change them? If that takes longer than an afternoon, start there. If you want a second set of eyes on the list, the team at Medix Dental IT is happy to compare notes.
Posted in Dental Cybersecurity, News
