DentaQuest breach hits at least 15 million people
US dental benefits firm DentaQuest says attackers were in its network from 17 to 20 May 2026. It is notifying at least 15 million people, and the extortion group ShinyHunters has leaked data it says it stole.
Key facts
- OrganisationDentaQuest, a Massachusetts dental benefits company owned by Sun Life.
- What happenedDentaQuest says unauthorised access ran from 17 May and ended by 20 May 2026, when it discovered it. No malware was involved, it says.
- Data affectedNames, addresses, Social Security numbers, member, Medicaid and Medicare numbers, and dental or vision health details such as diagnosis, treatment and billing. Data varies by person.
- ScaleDentaQuest says at least 15 million people. An independent researcher's analysis cited by HIPAA Journal suggests the total could exceed 23.4 million.
- ClaimedShinyHunters claims it took 234 GB relating to 2.6 million people and leaked it after talks failed. DentaQuest has not named the attackers.
- AuthoritiesThe 15 million figure was posted to the Oregon attorney general's breach site. A notice also went to the California attorney general.
Timeline
- 17 May 2026Unauthorised access to parts of DentaQuest's network begins. BankInfoSecurity · HIPAA Journal
- 20 May 2026DentaQuest discovers the access, which ended by that day. BankInfoSecurity · HIPAA Journal
- 5 Jun 2026DentaQuest has publicly acknowledged the incident. ShinyHunters lists it on its leak site and later publishes 234 GB. HIPAA Journal
- 17 Jul 2026DentaQuest begins mailing notification letters on a rolling basis. HIPAA Journal
- 31 Jul 2026DentaQuest's count of 15 million appears on the Oregon attorney general's site. BankInfoSecurity
Incident record
| Organisation | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|
| ✅ ConfirmedDentaQuest | 20 May 2026 | Health | Data leak | ShinyHunters | Confirmed. DentaQuest found unauthorized network access between 17 and 20 May 2026 and is notifying at least 15 million people. Claimed. ShinyHunters claimed 234 GB of stolen data and leaked it after talks failed. | HIPAA Journal✓ 7 Nov |
What to do
- Enrol in the 24 months of free credit and identity monitoring offered in your DentaQuest letter.
- Place a free credit freeze with Equifax, Experian and TransUnion, since Social Security numbers were exposed.
- Check Medicaid, Medicare and dental benefit statements for care you did not receive.
- Report identity theft at IdentityTheft.gov.
FAQ
How many people were affected by the DentaQuest breach?
DentaQuest says at least 15 million. A researcher's analysis of the leak suggests it could be over 23.4 million.
Who hacked DentaQuest?
ShinyHunters claims responsibility and leaked data. DentaQuest has not publicly named the attackers.
What is DentaQuest offering affected people?
24 months of free credit monitoring and identity theft protection.
Related stories
- Philippine agencies named in a wave of hack and leak claims Philippines · 7 Nov 2026
- Bank Rakyat website defacement Malaysia · 6 Nov 2026
- M1 customer data breach Singapore · 6 Nov 2026
- Amadeus airline data breach South Korea, Japan, Hong Kong +3 · 4 Nov 2026
Checked 7 Nov 2026. Methodology · Data CC BY 4.0