DentaQuest breach affects at least 15 million people, largest health breach of 2026
DentaQuest, the largest administrator of Medicaid and children's dental benefits in the United States, says at least 15 million people were affected by a breach of its network in May, making it the largest known health-care data breach of 2026, according to the HIPAA Journal.
Many of those affected are Medicaid and CHIP members, including children, who have little ability to protect themselves from identity fraud once their Social Security numbers are exposed.
What happened
DentaQuest, based in Wellesley, Mass., says an unauthorized party accessed parts of its network between May 17 and May 20, 2026, and that it discovered the intrusion on May 20. In a notice posted in early June, the company said it had contained the threat and was working with forensic investigators and law enforcement. Notification letters began going out on July 17.
According to the notice, the data involved includes names, addresses, Social Security numbers, member ID numbers, Medicaid and Medicare numbers, and dental and vision information such as provider names, diagnoses, treatment and billing details. DentaQuest is offering 24 months of credit monitoring and identity theft protection.
The leak
ShinyHunters claimed the attack, listed DentaQuest on its leak site and said it took 234 GB of data. The group said ransom talks failed and published the files. Have I Been Pwned, which added the data on June 3, found 2.6 million unique email addresses along with dates of birth, genders, government IDs and health insurance information. Much of the data sat in health-care enrollment files, some containing Medicaid IDs.
The HIPAA Journal reported that an independent researcher's analysis of unique name and birth date combinations suggests the total could reach 23.4 million, a figure DentaQuest has not confirmed. Some records date back to at least 2009.
What we don't know yet
DentaQuest has not explained how the attackers got in or confirmed the final count.
What to do
People who receive a DentaQuest letter should enrol in the monitoring offered and consider freezing their credit, including for children. Parents can request a credit freeze for a minor in the U.S. Be wary of calls or texts about dental claims or Medicaid coverage that ask for personal details.
