DentaQuest data breach: dental and vision health information accessed and posted online

What happened in the DentaQuest data breach?

DentaQuest says it later learned that the incident began on May 17, 2026 and ended by May 20, 2026. It says it took action to secure the network, reported the incident to law enforcement and began an investigation with outside cybersecurity experts. After its review it found that each recipient's personal information had been accessed and posted on the internet.

The letters do not say how the intruders got in, who they were, or where the data was posted. The federal list classes the breach as a hacking or IT incident on a network server.

Date	What the letters and the regulators' records say
May 17, 2026	The incident begins; date of breach on California's record and Washington's list
May 20, 2026	DentaQuest discovers the access; the incident has ended by this date
July 16, 2026	Notice recorded by California's attorney general and Washington's attorney general; report logged in Massachusetts; report submitted to HHS
July 17, 2026	Posted on the Texas attorney general's list; Indiana's report gives this as the date notice was sent

57 days passed between the discovery and the first regulator records. Federal health privacy rules require notice to individuals without unreasonable delay and no later than 60 calendar days after discovery. The filed letters carry no date of their own, so the mailing date is not known. The HIPAA Breach Notification Rule entry explains the deadlines, and the notice delay study shows how other organizations compare.

What information was involved in the DentaQuest breach?

The letter says the information included each person's name, other personal identifiers that the filed copy leaves as a blank field, and dental or vision health information such as provider names, diagnoses, treatments and billing information.

The state records fill in the blank field. Washington's list names Social Security numbers, full dates of birth, health insurance policy or ID numbers, medical information and protected health information. Texas's list adds addresses. Massachusetts' report marks Social Security numbers and medical records as breached, and financial accounts, driver's licenses and payment card numbers as not breached.

Information type	Letter	Washington	Texas	Massachusetts
Name	Yes	Yes	Yes
Social Security number	Blank field	Yes	Yes	Yes
Date of birth	Blank field	Yes	Yes
Address			Yes
Health insurance policy or ID number		Yes	Yes
Dental, vision or medical information	Yes	Yes	Yes	Yes
Financial account				No
Driver's license				No
Credit or debit card number				No

A blank cell means the source does not mention that type. Not every person's letter lists the same items: the filed copy fills the list from a data field for each recipient.

How many people were affected by the DentaQuest data breach?

The regulators' records give different totals, and none of the filings explains the gap.

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	15,000,000
Indiana attorney general	Total affected, as reported to Indiana	29,000,000
Indiana attorney general	Indiana residents	139,500
Texas attorney general	Texans	3,973,000
Massachusetts consumer affairs office	Massachusetts residents	1,905,700
Washington attorney general	Washingtonians	153,300

Its 139,500 Indiana residents make it the fifth largest of the 1,361 notices sent in 2026 in Indiana's report (Indiana ranking).

On each state list, DentaQuest's report sits at or near the top for 2026. It is the largest of the year in the Massachusetts ranking, second in the Texas ranking and in the national ranking from Indiana's report, and fifth in the Washington ranking. The state counts are residents only and cannot be added to the federal figure.

Why did I get a letter from DentaQuest?

DentaQuest writes to people whose health plan uses it, or used it, for dental or vision benefits. Many recipients know the plan rather than DentaQuest itself. The guide to letters from companies you never dealt with explains how that happens.

DentaQuest filed three versions of the letter with California: one for adults, one addressed to the parent or guardian of a child, and one addressed to the family of a person who has died.

What is DentaQuest offering people who got a letter?

Adults are offered Kroll identity monitoring for 24 months at no cost, with credit monitoring, fraud consultation and identity theft restoration. The children's version offers the same 24 months with minor identity monitoring in place of credit monitoring. The version sent to families of people who have died offers no monitoring; it describes DentaQuest's security changes and the steps families can take.

Item	Detail from the letter
Provider	Kroll
Length	24 months, at no cost
Enrollment	Enroll.krollmonitoring.com/redeem, with the activation code and verification ID printed on the letter
Deadline	90 days from the date the letter was mailed
Phone	1-844-959-7163, Monday to Friday, 8:00 a.m. to 5:30 p.m. Central Time, excluding major U.S. holidays

To get Kroll's credit services, a person must be over 18, have established credit in the U.S., have a Social Security number in their name and have a U.S. residential address on their credit file. The credit monitoring offers guide compares what other notices offer.

What DentaQuest says it changed

The letter says DentaQuest brought in cybersecurity experts, gave employees more training, added new security measures and increased monitoring. It does not describe the measures.

What the documents leave open

• How the unauthorized individuals got into the network, and whether ransomware was involved. The letters do not say.
• Where the data was posted, and whether it is still available.
• Why the federal total (15,000,000) and the total reported to Indiana (29,000,000) differ.
• When the letters were mailed. The filed copies carry a date placeholder, and the 90-day enrollment window runs from that date.

Is the DentaQuest breach letter real?

DentaQuest filed its letters with California's attorney general, which posts them on its breach record for the company. A letter that matches the filed copy gives the Kroll number 1-844-959-7163 and the enrollment site Enroll.krollmonitoring.com/redeem. Calling the number printed in the filed copy, rather than one in an unexpected email, is the safer check.

How long do I have to sign up for DentaQuest's Kroll monitoring?

90 days from the date the letter was mailed. The date is printed on each letter; the filed copies leave it blank.

Was my Social Security number exposed in the DentaQuest breach?

It may have been. Washington, Texas and Massachusetts all record Social Security numbers among the information involved. Each letter lists the items for that person, so the letter you received is the answer for your own data.