Skip to content
HACKTECH
BreachesReported Published 3 sources

DentaQuest notifies 15 million people after a May 2026 network intrusion

DentaQuest, which BankInfoSecurity describes as one of the largest dental and vision benefits administrators in the United States, discovered on 20 May 2026 that unauthorised individuals had accessed certain data on its computer network in an incident that began on 17 May. Its notice says the affected data, which varies by individual, includes names, addresses, Social Security numbers, member ID numbers, Medicaid and Medicare numbers and dental or vision health information. DentaQuest's report to the Oregon Department of Justice lists 15,000,000 people affected. BankInfoSecurity reported that the ShinyHunters group claimed on its leak site to have published DentaQuest data.

  • healthcare
  • insurance
  • dental benefits
  • Medicaid
  • HIPAA
  • ShinyHunters
  • data extortion

What the sources report

  • DentaQuest's notice says the incident began on 17 May 2026 and ended by 20 May, the day it was discovered; the notice was first published on 26 May, and individual letters began on 17 July.
  • The Oregon Department of Justice breach list shows a DentaQuest LLC report dated 16 July 2026 covering 15,000,000 people, with breach dates of 17 to 19 May 2026; BankInfoSecurity said the hack is on track to rank as the biggest health data breach so far in 2026.
  • BankInfoSecurity reported that ShinyHunters posted on its leak site in May that it had published 234 GB of DentaQuest data related to 2.6 million people, saying the company 'failed to reach an agreement'.
  • DentaQuest told ISMG that none of its operating systems were impaired, that no malware was involved, and that Kroll is reviewing the data.
  • The notice does not say how access was gained; DentaQuest says it secured its network, reported the incident to law enforcement, is offering 24 months of identity monitoring through Kroll, and has added enhanced security and monitoring controls and employee training.

What it means for your organisation

DentaQuest told ISMG that no malware was involved, and in an intrusion without malware, detection depends on identity, data-access and egress telemetry rather than endpoint alerts. Benefits administrators hold member records for the health plans they serve, so segmentation and field-level protection of identifiers decide how far a single foothold reaches.

What we check

  • Review monitoring for bulk reads and exports from member databases and file stores, with alerts on unusual query volumes and outbound transfer sizes.
  • Audit which users and service accounts can read complete member records, and whether Social Security, Medicaid and Medicare numbers are encrypted or tokenised at field level.
  • Test identity-based intrusion paths that leave no malware trace, such as helpdesk MFA resets and abuse of single sign-on sessions.
  • Exercise a data-theft extortion playbook without encryption: forensic scoping of affected individuals, HIPAA and state notification timelines, and handling of leak-site claims.

Sources

Services that cover these checks

  • Database security audit

    A configuration and access review of your production databases: who can connect, from where and with which privileges, whether data is encrypted at rest and in transit, what is logged, and whether backups would survive the same attacker. We read each instance's live configuration.

    Duration: 3 to 7 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

  • Social engineering assessment

    Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.

    Duration: 2 to 4 weeks including campaign preparation

  • Network & infrastructure testing

    Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.

    Duration: 5 to 12 working days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow incident response works