DentaQuest, the largest administrator of Medicaid and Children's Health Insurance Program (CHIP) dental benefits in the United States, has suffered a cyberattack that exposed the personal information of as many as 23.4 million people. The breach reached far beyond basic contact details, exposing Social Security numbers, Medicaid and Medicare ID numbers, and even diagnosis and treatment records.
ShinyHunters, the group behind the attack, first posted the stolen data on the dark web in May and claimed 2.6 million victims. Official notification letters DentaQuest began sending out in mid-July put the number above 15 million. Later, the security analysis outlet SecurityAffairs reported a figure exceeding 23.4 million. According to the healthcare trade publication HIPAA Journal, the source of the count changed three times over three months, and the scale grew larger each time.
Three Days of Unauthorized Access and a Dark Web Leak
According to DentaQuest, an external attacker gained unauthorized access to the company's network for three days, from May 17 to 20. The company said it discovered the intrusion on the 20th, immediately cut off network access, and reported the incident to law enforcement. ShinyHunters claimed to have stolen 234 gigabytes of data and demanded a ransom. When negotiations broke down, the group posted the stolen data on its dark web leak site.
Identity and Treatment Data Exposed at the Largest US Administrator
Headquartered in Wellesley, Massachusetts, DentaQuest is the U.S. dental subsidiary of life insurer Sun Life. It is also the largest administrator of Medicaid and CHIP dental benefits across all 50 states. The exposed information included names, addresses, Social Security numbers, Medicaid and Medicare ID numbers, diagnosis and treatment histories, and billing information. Reports indicate the data of many child beneficiaries was included as well. DentaQuest has said it manages dental benefits for 32 million people nationwide, meaning the 23.4 million affected represent a large share of that total.
Victim Support, a Suspect's Arrest, and Korea's Security Challenge
DentaQuest said it would provide affected individuals with 24 months of free credit monitoring and identity theft protection services. ShinyHunters has carried out similar attacks against multiple companies this year. According to the Associated Press, a person believed to be a member of the group was arrested in the Netherlands on the 29th of last month and detained for 90 days.
DentaQuest does not operate in Korea, so Korean dental patients will not be directly affected by this breach. Still, the fact that dental care is a weak link in data security applies here too. The website of HASS, a Korean maker of dental esthetic restoration materials, was also hacked in 2024, exposing members' names and contact information. As with HeyDonto, covered earlier, the more dental records are linked with medical electronic health records, the wider the scope of information exposed when a single point is breached. That is a challenge both countries still face.