Dental Practice Data Breaches 2026: 39 HHS Reports by Oct 9, Up From 18 a Year Earlier

Dental practice data breaches 2026: as of November 5, 2026, the HHS breach portal lists 39 dental reports of 500 or more people, all filed by Oct 9, 2026, against 18 in the same window of 2025. Six came from one Texas dental group on one day. Excluding insurer DentaQuest’s 15 million, they cover 319,898 people.

What changed most recently

The newest dental rows on the portal, which we pulled on 2026-11-05: Bright Smile Dental Care (IN, 7,601 people, 2026-10-01); Lift Dental PLLC dba Artistic Smiles (CO, 3,735 people, 2026-09-18); Young C. Park DDS., PC d/b/a Park Dental (VA, 12,400 people, 2026-09-18); Wichita Family Dental (KS, 1,273 people, 2026-09-11). The portal’s newest row of any kind is Oct 9, 2026, so filings from the last four weeks may be missing. Three things that portal does not yet show: Park Dental Partners’ October 7, 2026 8-K, saying data was acquired and patients are being notified after an August 28 intrusion; billing vendor eAssist’s incident, disclosed to customers on September 8; and 7 to 7 Dental and Orthodontics, posted by the Texas AG on 2026-10-02 with 3,526 Texans.

Every 2026 dental breach on the HHS portal

Filter by state or type, or tap a column head to sort. Dates are submission dates to HHS, not breach dates. People counts are as filed.

Source: HHS OCR breach portal, Under Investigation and Archive tabs, retrieved 2026-11-05. 3 of the 39 rows (Facial Surgery Group PC and two Drs. Abdelbaky, Boes, Cameron and Associates rows) were added by hand after an NPI registry check, because the name rule misses them.

Who was actually breached: practice, group, vendor or insurer

A vendor breach and a compromised office server need different responses, so we split them. 25 of the 39 reports are practices reporting their own incident, covering 257,832 people. Another 6 are offices of a single group, and 5 name a business associate as present.

Vendor and payer events a dental MSP should know

Dental breaches by month

July is the peak, with 13 reports in 2026. Six of them are the Soniva filings and one is DentaQuest; without those seven, July has 6, in line with the rest of the year. Per-month people totals sit in each column’s tooltip, because DentaQuest’s single row would flatten any chart of people.

How big is a dental breach, and how did it happen?

A dental breach is not smaller than a typical healthcare breach. The median dental report without the insurer rows is 5,552 people, against 4,497 for all 618 healthcare reports in 2026. A year earlier the medians were 4,984 and 4,946, so a gap of this size is not a trend. Part of it is placeholders: 58 of the 618 healthcare rows sit at exactly 500 or 501, and without them the all-healthcare median is 5,443, close to the dental figure.

Network servers appear in 67% of dental reports against 72% for all healthcare, and email in 36% against 20%. The email gap is not stable: on the name rule alone, dental email was 24% against 26% for all healthcare in the same window of 2025, and the vendor group’s four email rows lift this year’s number. Only 2 of 39 dental reports name an electronic health record as a location. The filings do not name a practice-management product, so nothing here says any one product was at fault.

Five-year trend, 2021 to 2026

Dental reports rose from 17 to 36 on the name rule while all healthcare fell from 648 to 618, taking the dental share from 2.6% to 5.8%. Grouped filings explain part of that, not all of it: by incident the count still goes from 16 to 30. The 2021 count needs the same care, since 12 of its rows are one Professional Dental Alliance incident. The same calendar window removes the obvious lag problem, but the portal cannot tell us whether more dental offices were attacked or more of them now report.

Largest dental entries, 2021 to 2026

Name rule only. Managed Care of North America (MCNA, a dental insurer) has no dental word in its portal name, so the rule misses it: 8,627,242 people, submitted 2023-05-26. One page in the current search results says 88 million people’s dental data was exposed in the first ten months of 2024. Dental-named rows for those months total 1.4 million people on the portal.

Dental breaches by state

What state attorney general lists add

The HHS public list stops at 500 people. Indiana and Massachusetts list notices as small as one person, and Texas shows at least one dental filer with no HHS row yet. Together they add dental breaches the portal does not show, and better counts for some it does.

Issaqueena shows why the 500-person line understates some rows: the HHS figure of 501 sits next to 91,250 on Indiana’s list, so 39 reports covering 319,898 people outside DentaQuest is a floor. Cure Dental shows the lag: Texas records discovery on 2025-06-25 and posting on 2026-07-17, 387 days apart.

Counts can also disagree outright: Aldrich Pediatric Dentistry is 5,900 on HHS and 40 on Indiana’s list. Tieu Dental’s letter gives another clock: network access on July 28 and 29, 2025, files identified on January 11, 2026, HHS filing on March 5, 2026. Washington’s list is the only one that codes a cause in these cases: Bayside Dental, ransomware, 9,683 Washington residents, and DentaQuest, phishing.

We did not use Oregon’s list, because its robots.txt disallows automated access, or Maine’s, which returned an access error. Under HHS’s rule, breaches under 500 people may be reported annually, within 60 days of the end of the calendar year, and larger ones within 60 days. The public list covers only the larger ones, so nobody outside HHS can count small dental incidents.

OCR enforcement that hit dental offices

We read the documents on OCR’s resolution agreement page we could open and found 12 actions against dental organizations, totalling $535,500. Of those, 6 are right-of-access cases, 3 involve online reviews or social media, one is a marketing disclosure, one (Shen Smiles) grew from an access complaint into records and training failures, and one is a hack at a software vendor. So among the actions we found, breach-driven enforcement has reached one dental organization, while the 2026 tracker above is 97% hacking. Our HIPAA enforcement tracker covers every OCR action across healthcare.

The median against a practice is $30,000, and the largest is Shen Smiles at $140,000, a solo office whose case started as one patient’s records request in April 2020 and ended in August 2026. MMG Fusion paid $10,000 on about 15 million people, and OCR says it weighed the company’s financial condition. Security Rule changes that would add duties for offices like these are still proposed, as our HIPAA Security Rule changes page records.

What this means for MSPs

Hacking is 97% of these filings, 67% name a network server and 36% a mailbox, 5 flag a vendor, and Absolute Dental’s 2025 letter names its MSP’s account as the route in. Here is what each failure suggests for a small dental office.

You may be a business associate yourself if you can reach patient data. Our healthcare data breach report has the wider vendor share across all providers, and the ransomware initial access data helps rank which of these controls goes first. Not legal advice; ask counsel about your contract.

Frequently asked questions

How many dental practice data breaches were reported in 2026?

39 dental reports of 500 or more people appear on the HHS portal from January 1 to Oct 9, 2026, including 2 from dental insurer DentaQuest. That compares with 18 in the same window of 2025. Counting one event once, we get 31 incidents against 17.

What was the largest dental data breach in 2026?

HHS lists DentaQuest, LLC at 15,000,000 people, submitted Jul 16, 2026. Its notice letter says unauthorized individuals accessed its network from May 17 to May 20, 2026, and that data was posted on the internet. Washington’s AG list records the cause as phishing. Indiana’s list shows 27,400,000 in total. Letters offer 24 months of Kroll identity monitoring.

Was there a Delta Dental data breach in 2026?

No Delta Dental entity appears on the HHS portal in 2026 as of Oct 9, 2026. The 2026 Delta Dental news is a $2.25 million New York Department of Financial Services penalty, announced April 30, 2026, over the 2023 MOVEit incident and late reporting. Delta Dental of Virginia reported a separate breach in 2025 (126,953 people on the HHS portal).

What is the Kroll letter about the DentaQuest breach?

DentaQuest’s sample letter filed with the California Attorney General offers Kroll identity monitoring for 24 months, with 90 days from the mailing date to enroll. It lists name and dental or vision details such as provider, diagnosis, treatment and billing, with other data elements varying by person.

Is there a DentaQuest data breach lawsuit?

Trade reports describe several class actions in federal court in Massachusetts, but they disagree on case numbers and dates. We could not check a docket, so we list none. No settlement appears in any source we read.

Have dentists been fined under HIPAA for data breaches?

We found 12 OCR actions against dental organizations from 2019 to 2026. 6 are right-of-access cases and 3 involve online reviews or social media. Only MMG Fusion, a dental software vendor, involves a hack. The newest is Shen Smiles, $140,000, on August 10, 2026.

Methodology

References

1. HHS Office for Civil Rights, Breach Portal. Accessed November 2026.
2. HHS OCR, Resolution Agreements and Civil Money Penalties. Accessed November 2026.
3. HHS, MMG Fusion settlement press release, March 5, 2026. Accessed November 2026.
4. HHS OCR, MMG Fusion resolution agreement. Accessed November 2026.
5. HHS OCR, Shen Smiles resolution agreement. Accessed November 2026.
6. HHS, Breach Notification Rule. Accessed November 2026.
7. California AG, DentaQuest LLC notice. Accessed November 2026.
8. California AG, Tieu Dental Corporation notice. Accessed November 2026.
9. California AG, Absolute Dental Group notice. Accessed November 2026.
10. California AG, data breach list. Accessed November 2026.
11. Texas AG, data security breach reports. Accessed November 2026.
12. Indiana AG, year-to-date breach report. Accessed November 2026.
13. Massachusetts OCABR, 2026 data breach report. Accessed November 2026.
14. Washington AG, data breach notifications. Accessed November 2026.
15. Park Dental Partners, Form 8-K, September 1, 2026. Accessed November 2026.
16. Park Dental Partners, Form 8-K, October 2026. Accessed November 2026.
17. NYDFS, Delta Dental settlement press release, and consent order. Search-index text; direct fetch blocked. Accessed November 2026.
18. Georgia Dental Association, eAssist notice summary, September 9, 2026. Accessed November 2026.
19. Denticle blog, copy of eAssist customer notice, September 28, 2026. Accessed November 2026.
20. The HIPAA Journal, Soniva Dental Care report (secondary). Accessed November 2026.
21. The HIPAA Journal, multiple dental practices report (secondary). Accessed November 2026.
22. Medix Dental IT, dental data breaches by state (secondary, cross-check only). Accessed November 2026.
23. CMS, NPI Registry. Accessed November 2026.