Park Dental Partners Data Breach: What It Means for Dental Practices

Park Dental Partners has now filed two cybersecurity disclosures with the Securities and Exchange Commission about the same incident, and the second one answered the question the first left open.

On September 1, 2026, Park Dental Partners, Inc., the Nasdaq-listed support organization for the Park Dental practices, filed a Form 8-K disclosing that it had identified unauthorized access to its computer network on August 28, 2026. On October 13, 2026, it filed a second 8-K stating that its investigation had determined that data “was subject to unauthorized acquisition,” and that it had identified impacted patients whose protected health information was involved. In its August 2026 quarterly report, the company said it supports 219 dentists across 87 practice locations in Minnesota, Wisconsin and Arizona.

The short answer: Park Dental Partners identified unauthorized network access on August 28, 2026, and by October had confirmed that data was taken and that patients’ protected health information was involved. Its October filing says it notified law enforcement and is completing patient notifications. As of October 20, 2026, neither SEC filing states how many patients are affected or describes the incident as ransomware. Four putative class actions have been filed in Minnesota state court, the first two days after the initial disclosure. Separately, the Chaos ransomware group listed parkdental.com on its leak site on October 1, a claim neither filing addresses. This is the company’s second disclosed incident, after an email compromise discovered in January 2024.

What the two SEC filings say

The September filing says the company “promptly initiated its incident response protocols, and engaged its external cybersecurity and forensic specialists,” and was “continuing to investigate the nature and scope of this incident, including the scope of any compromise of personal or protected health information.” It added that the incident “has not materially disrupted the Company’s operations, however, due to the possible access of patient data, we are treating this as a reportable event.”

The October filing moves from possible access to confirmed acquisition. It says the company “notified law enforcement,” that “the investigation has determined that data was subject to unauthorized acquisition as a result of the incident,” and that it “has identified impacted patients whose protected health information was involved and is completing notifications pursuant to applicable state and federal law.” It also says the company is “not aware of any unauthorized use of protected health information or any damages as a result of the incident,” that it “anticipates regulatory responses,” and that it has not identified a material financial impact, “including the current expected legal and advisor cost to address the incident.”

Neither filing says how many patients are involved, which types of data, how the attacker got in, or whether any systems were encrypted.

Why a dental group files with the SEC at all: Park Dental Partners is publicly traded, and SEC rules adopted in 2023 require public companies to disclose a cybersecurity incident under Item 1.05 of Form 8-K within four business days of determining that it is material. That clock runs from the materiality determination, not from discovery. Park supplied its additional information in a second Item 1.05 filing, reporting events as of October 7. Private practices and privately held DSOs have no equivalent filing, though HIPAA and state breach laws still apply to them. We covered what public dental companies tell the SEC about cybersecurity, Park Dental Partners included, before this incident.

Four lawsuits within weeks of the first disclosure

The October filing lists four putative class actions in the Second Judicial District Court for Ramsey County, Minnesota: Wyckoff (62-CV-26-6341), Jahnke and Sonia (62-CV-26-6381), Lama (62-CV-26-6384) and Murphy and Palm (62-CV-26-7111). The first was filed on September 3, 2026, two days after the first 8-K and more than a month before the company said it was completing patient notifications.

According to the company’s summary, the suits allege it failed to safeguard patients’ protected health information or to implement reasonable security measures, and that it failed to notify affected people in time. The claims include negligence, negligence per se, invasion of privacy, breach of fiduciary duty, unjust enrichment, breach of implied contract and breach of confidence. On October 7, the plaintiffs moved to consolidate the four cases and appoint interim lead class counsel. The company says it intends to defend itself vigorously. The October filing describes allegations, not findings.

For any dental group, the timing is the point. In this case, litigation began before the company had publicly disclosed the scope of affected patient information. We tracked what dental data breach lawsuits have actually settled for and how fast they followed the patient letters.

What the Chaos listing does and does not tell you

On October 1, 2026, the leak-site tracker ransomware.live recorded a listing by the Chaos group naming parkdental.com and giving the company 24 hours to make contact. The tracker shows 275 GB as the amount of data the group claims to have taken.

Treat all of that as the attacker’s claim. Neither SEC filing names an attacker, uses the word ransomware, or mentions a ransom demand, and we could not confirm whether any data was published. The listing does not establish who carried out the intrusion or verify the claimed data volume. It does fit a pattern we see across dental ransomware leak-site listings: the claim often surfaces before a patient count or a federal breach report does, and sometimes instead of one.

Three organizations with similar names

Similar names make these reports easy to confuse.

• Park Dental Partners, Inc. is the Minnesota-based, Nasdaq-listed organization supporting the Park Dental practices in Minnesota, Wisconsin and Arizona. Its incident is the one in the two 8-K filings above.
• A single-office practice in Roanoke, Virginia, also named Park Dental, issued its own notice in September about unauthorized remote access to a workstation and email account between June 10 and July 22, 2026. According to local news coverage, the notice said investigators found no indication that patient data was taken. We found nothing connecting it to Park Dental Partners.
• Park Dental Research is an Oklahoma-based dental supply company that the Interlock ransomware group listed in May 2026. It is a separate organization and a separate incident.

The 2024 incident at Park Dental

Park Dental Partners’ annual report, filed in March 2026, describes an earlier incident: on January 23, 2024, the company became aware of unauthorized activity involving a limited number of employee email accounts. Its 2024 patient notice says access ran from January 11 to January 23, 2024, and was limited to its Microsoft 365 environment rather than its internal network or patient records database. The notice listed potentially affected information that varied by individual, including names, medical and health insurance information and dates of birth, and for a limited number of people Social Security numbers and financial account information. The federal Office for Civil Rights breach portal lists 185,606 affected individuals for Park Dental and 38,442 for The Dental Specialists (HIPAA Journal reported 238,667 for Park Dental in August 2024), which is why the incident appears on our list of the biggest dental data breaches. The annual report says the company believes it has substantial defenses to the related litigation.

The same annual report describes the security program the company had in place: a program built on the NIST Cybersecurity Framework, multi-factor authentication on critical systems, encryption, firewalls, intrusion detection, vulnerability management, periodic penetration testing, a written incident response plan with tabletop exercises, and board oversight through the audit committee.

	2024 incident	2026 incident
Identified	January 23, 2024	August 28, 2026
Environment	Employee email accounts in Microsoft 365	The computer network. Entry point not disclosed
Patients	185,606 (Park Dental) and 38,442 (The Dental Specialists) on the OCR breach portal	Not stated in either SEC filing. The company says it is completing notifications
Disclosure	Patient notice and HHS report, before the company was public	Two SEC 8-K filings, September 1 and October 13, 2026
Litigation	Litigation followed. The company says it has substantial defenses	Four putative class actions, consolidation motion filed October 7, 2026

What these disclosures leave unanswered

The annual report describes the company’s security program. None of the filings establish how the intrusion happened or how particular controls performed, and I am not going to guess. The two incidents involved different environments, email in 2024 and the network in 2026, and the 2026 entry point remains unknown.

What I would take from it is narrower and more useful. A documented program is a starting point, and the only way to know it is working is to test it. If a group with 87 locations, a NIST-based program, MFA on critical systems and a written response plan can still have data taken, every multi-location group should know when it last verified that its controls are on everywhere and that someone is reading the alerts.

What a dental practice or DSO should do now

Nothing here depends on how the Park Dental investigation resolves. I would use these disclosures to review five things in any group.

1. Check enforcement, not availability

Is MFA enforced for every user and administrator who can reach patient data, including remote access and payer portals? Separately, how are service accounts authenticated, restricted and monitored? Review the exception list and confirm that each exception still has an owner and a reason.

2. Treat email and cloud identity as clinical systems

The 2024 Park Dental incident started in employee email and still involved patient information, because inboxes and shared drives collect the same data the practice management system holds. Confirm that mailbox auditing, forwarding-rule alerts and suspicious sign-in alerts are on and going to someone who reads them.

3. Check what one account can reach

Check whether acquired locations still share broad network access or administrative permissions. Scope access by role, location and function, so that one compromised login is not every office.

4. Watch for data leaving, not just for encryption

Park Dental Partners says its operations were not materially disrupted, and its investigation still found that data was taken. Ask your IT provider whether anyone would notice a large outbound transfer from a server overnight, and how quickly.

5. Plan for the lawsuit and the claim arriving before the scope is known

Here the first class action came two days after disclosure and the leak-site claim came a month later, both before a patient count was publicly disclosed. Decide now who speaks for the group, what you tell patients and staff while the scope is still open, and who your breach counsel and cyber carrier are. Then confirm which systems record access and exports, and how long those records are kept, because that is what lets investigators define the scope. Our ransomware incident response guide for dental practices covers the first hours.

Park Dental Partners Data Breach FAQs

What happened in the Park Dental Partners data breach?

Park Dental Partners identified unauthorized access to its computer network on August 28, 2026, and disclosed it in an SEC Form 8-K on September 1, 2026. In a second 8-K filed October 13, 2026, it said its investigation had determined that data was subject to unauthorized acquisition and that patients’ protected health information was involved, and that it had notified law enforcement and was completing patient notifications.

Was patient data exposed in the Park Dental Partners breach?

According to the company, yes. Its October 13 filing says it “has identified impacted patients whose protected health information was involved.” Neither SEC filing states how many patients or which types of information, and it says it is not aware of any unauthorized use of that information. A count may first appear in a company update, a state attorney general filing or the federal breach portal.

Was the Park Dental Partners breach a ransomware attack?

Neither SEC filing says so. They do not name an attacker, mention encryption or mention a ransom demand. On October 1, 2026, the Chaos ransomware group listed parkdental.com on its leak site and claimed 275 GB of data. That is the group’s claim, and neither filing addresses it.

Are there lawsuits over the Park Dental Partners breach?

Yes. The October filing lists four putative class actions in Ramsey County, Minnesota, the first filed September 3, 2026. They allege the company failed to protect patient information and to notify people in time. On October 7, 2026, the plaintiffs moved to consolidate the cases. The company says it will defend itself, and the claims are allegations.

Has Park Dental had a data breach before?

Yes. In January 2024, the company found unauthorized activity in a limited number of employee email accounts in its Microsoft 365 environment. The federal Office for Civil Rights breach portal lists 185,606 affected individuals for Park Dental and 38,442 for The Dental Specialists, and the company’s March 2026 annual report says it believes it has substantial defenses to the related litigation.

Is the Roanoke Park Dental breach the same incident?

No. A single-office practice in Roanoke, Virginia, also named Park Dental, reported its own incident in September 2026 involving access between June 10 and July 22, 2026. We found no connection between it and Park Dental Partners, which operates in Minnesota, Wisconsin and Arizona. Park Dental Research, an Oklahoma dental supply company listed by the Interlock group in May 2026, is also unrelated.

What should we watch for next?

Company updates, state attorney general filings and patient notice letters, any of which may give a patient count. An entry on the federal breach portal, which lists breaches affecting 500 or more people. A ruling on the motion to consolidate the lawsuits. And any further 8-K, since the company says it will update its disclosure as information becomes available.

The pattern behind this one

Dental data is valuable, and dental groups increasingly concentrate it. That is the thread running from the eAssist incident to this one. For operators, the practical question is how their controls are tested and monitored across every location, and when that was last checked.

If your group wants a second set of eyes on whether its controls are actually enforced, that is what we do at Medix Dental IT. A cybersecurity assessment is the place to start, and our dental office cybersecurity checklist covers the controls we look for first.

Posted in Dental Cybersecurity, News