DentaQuest Breach: 2.6M Records Exposed by ShinyHunters (2026)
In May 2026, the dental benefits administrator DentaQuest was the target of a ShinyHunters "pay or leak" extortion campaign that resulted in the group publicly publishing hundreds of gigabytes of data allegedly obtained from the company. The data included 2.6M unique email addresses along with names...
Overview
On May 26, 2026, the notorious threat group ShinyHunters launched a “pay or leak” extortion campaign against DentaQuest, one of the largest dental benefits administrators in the United States. The attackers published hundreds of gigabytes of data online after DentaQuest refused to pay a ransom. The breach exposed 2,553,599 unique email addresses, along with names, phone numbers, and physical addresses. The data included sensitive healthcare enrollment files (ASC X12 transaction sets), some containing Medicaid IDs, and member records. DentaQuest acknowledged “a cybersecurity incident involving unauthorized access to a limited portion of our network” and stated they had contained the attack, but the damage was already done - the data was publicly dumped.
What Was Exposed
The leaked data set is a goldmine for identity thieves and scammers. The core elements include:
- Email Addresses: All 2.5M+ unique emails are now in the hands of criminals, making them prime targets for phishing campaigns.
- Names and Phone Numbers: These enable personalized social engineering attacks, such as calls pretending to be from DentaQuest or healthcare providers.
- Medicaid IDs (in some records): While not present in all files, the inclusion of state Medicaid identifiers in X12 enrollment data elevates the risk significantly. A Medicaid ID, combined with a name and address, can be used to file fraudulent claims or enroll in benefits.
How the Breach Happened
ShinyHunters is a known extortion group that targets poorly secured databases and cloud storage. In this case, they claimed to have accessed DentaQuest’s network through an exposed or misconfigured server - a common vector for healthcare data theft. The group did not encrypt files as in a typical ransomware attack; instead, they exfiltrated the data and threatened to release it. When DentaQuest did not pay, ShinyHunters made good on their threat, posting the full cache on a leak site. This is a classic “pay or leak” scenario that has become increasingly common in cybersecurity news targeting the healthcare sector.
Who’s Actually Affected
While DentaQuest is the named entity in this breach, the actual victims are the patients whose data was held by the company. This includes thousands of individuals enrolled in Medicaid and commercial dental plans administered by DentaQuest. The breach is particularly concerning for low-income individuals dependent on Medicaid, as their Medicaid IDs are now exposed. Additionally, anyone who submitted a claim or enrolled in a DentaQuest plan during the affected period may have their data in the leaked files.
How to Check If You’re Affected
You can check if your email address was included in the DentaQuest breach by using the Have I Been Pwned (HIBP) database. Visit haveibeenpwned.com and enter your email address. If it appears in the DentaQuest or any related incident, follow the recommendations below. For a full account of the ShinyHunters claim, see our DentaQuest Ransomware Attack analysis and the initial ransomware claim report.
What to Do Right Now
- Enable account take-over protections: If you have a DentaQuest online account, change your password immediately. Enable two-factor authentication (2FA) if available. Use a unique, strong password not shared with other services.
- Watch for phishing attempts: Expect emails, texts, or calls that mention DentaQuest, your benefits, or your Medicaid status. Do not click links in unsolicited messages. Verify any communication by calling DentaQuest directly using a known number from their official website.
- Secure your email: Since your email address is exposed, change your email account password and enable 2FA. Your email is the key to resetting passwords for other accounts.
- Monitor for identity theft: Check your credit reports at annualcreditreport.com. If your Medicaid ID was exposed, contact your state Medicaid office to report the breach and ask about protective measures. You may be eligible for identity theft monitoring services.
Security Insight
This breach highlights a recurring failure in the healthcare sector: treating patient data as a business asset rather than a fiduciary responsibility. DentaQuest’s delayed acknowledgement - and the fact that a third-party extortion group gained access to sensitive Medicaid enrollment files - suggests insufficient network segmentation and outdated access controls. Compared to similar attacks on dental insurers like Delta Dental in 2024, the pattern is identical: exposed data from an extorted server leads to a public dump. The real lesson is that “pay or leak” attacks will continue until healthcare organizations adopt zero-trust architectures that make exfiltration impossible, not just alarming.
Further Reading
Investigate Breaches Safely with NordVPN
Researching exposed data, paste sites, or threat actor infrastructure? Route your OSINT traffic through a VPN to avoid attribution and keep your investigation IP separate from your corporate network.
Get NordVPN for ResearchAffiliate link — we may earn a commission at no extra cost to you.
Never miss a data breach report
Get real-time security alerts delivered to your preferred platform.
Related Breach Reports
In May 2026, the telecommunications company Charter Communications (the parent company behind the consumer broadband and cable brand Spectrum) was named by the ShinyHunters group in a "pay or leak" extortion campaign . The group later published the data, which exposed 4.9M unique email addresses alo...
In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a "pay or leak" extortion campaign . The attackers allegedly accessed Kemper's Salesforce environment via social engineering as part of a broader campaign targeting hundreds of ...
In March 2026, the financial services firm Ameriprise Financial was named by the ShinyHunters group in a "pay or leak" extortion campaign . The group claimed possession of more than 200GB of compressed data exfiltrated from Ameriprise's Salesforce environment and internal SharePoint infrastructure, ...
In April 2026, 7-Eleven was the victim of a "pay or leak" extortion campaign by ShinyHunters , with the data later published that month. The incident exposed 185k unique email addresses, along with names, physical addresses, dates of birth and phone numbers. A small number of records also contained ...