FlagThis

← Back to Daily Briefing

DentaQuest Data Breach: 2.6 Million Dental Member Records Exfiltrated

Published June 20, 2026
Breach/Leak🏢 DentaQuest#DataBreach#DentaQuest#ShinyHunters#HIPAA#HealthcareSecurity

DentaQuest, a major dental benefits administrator, has suffered a significant data breach resulting in the exfiltration of approximately 234GB of sensitive records belonging to 2.6 million members. Attributed to the threat actor group ShinyHunters, the breach includes high-value Protected Health Information (PHI), dental insurance records, and Personally Identifiable Information (PII). While the specific initial access vector—potentially involving credential theft, zero-day exploitation, or cloud misconfigurations—is still being determined, the incident presents an acute risk for medical identity theft and sophisticated phishing campaigns. Immediate forensic investigation into lateral movement and data egress protocols is critical for remediation and regulatory compliance.

  • Incident Overview

    • Target Entity: DentaQuest, a large-scale dental benefits administrator.
    • Breach Scale: Approximately 2.6 million member accounts compromised.
    • Data Magnitude: Approximately 234GB of exfiltrated information.

  • Attack Vector & Technical Mechanics

    • Threat Actor: Attributed to ShinyHunters, a group known for large-scale exfiltration and extortion.
    • Investigation Vectors: Potential initial access via credential theft, zero-day exploitation, or cloud storage misconfigurations.
    • Forensic Focus: Analysts are prioritizing the identification of lateral movement patterns and specific exfiltration protocols used to bypass egress monitoring.

  • Threat Actor Profile & Data Impact

    • Actor Intent: High probability of data being utilized for extortion or sale on dark web marketplaces.
    • Compromised Data Types: PHI, PII, dental insurance details, and member contact information.
    • Secondary Exploitation: Elevated risk of insurance fraud and highly targeted social engineering attacks against the affected population.

  • Regulatory & Defensive Implications

    • Compliance Risk: High potential for HIPAA violations and significant regulatory fines from the HHS Office for Civil Rights (OCR).
    • Operational Impact: Significant costs associated with mandatory breach notifications and disruption of dental benefits administration.
    • Mitigation Priority: Strengthening Identity and Access Management (IAM) and enhancing monitoring of unusual data egress volumes.

Related posts

  1. Risky Business Newsletters — Risky Bulletin: UK NCSC blasts SOC metrics
  2. Wiu
  3. Cybersecurityventures
  4. Elastic
  5. Haveibeenpwned
  6. Medixdental
  7. Security Affairs — DentaQuest Breach: ShinyHunters Publish Data Impacting 2.6M People
  8. Reddit
  9. Dark Reading — Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories
  10. haveibeenpwned.com — University of Nottingham - 454,635 breached accounts
  11. bleepingcomputer.com — Nottingham University data breach affects over 450,000 students
  12. feeds.feedburner.com — ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Action Patch + 28 New Stories
  13. The Record by Recorded Future — University of Nottingham confirms cyber incident as Shiny Hunters group claims data theft
  14. Safedep
  15. Threatlocker
  16. Bnnbloomberg
  17. Taiwannews
  18. Gurufocus
  19. Globalbankingandfinance
  20. Thenews
  21. Economictimes
  22. Gurufocus
  23. Wmbdradio
  24. Wtvbam
  25. Streetinsider
  26. Tradingview
  27. Itpro
  28. Securityweek
  29. Cybersecurity News — 400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers
  30. bleepingcomputer.com — Over 400 Arch Linux packages compromised to push rootkit, infostealer
  31. Cybelangel
  32. feeds.feedburner.com — Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
  33. Security Affairs — Iran-Linked Handala Breached a California Water Utility. It Could Have Done Worse, and It Knows That.
  34. cybersecurity.pk — Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
  35. Discuss
  36. threat-modeling.com — Arch Linux AUR Supply Chain Compromise: 400+ Packages Distributing Rootkit and Infostealer
  37. techjacksolutions.com — AUR Supply Chain Attack: 400+ Packages Weaponized with eBPF Rootkit and Credential Stealer via npm Dependency
  38. techjacksolutions.com — Arch Linux / AUR Ecosystem — Vulnerability Rollup (2026-06-13)
  39. Isssource
  40. Scworld
  41. Dataminr
  42. Note
  43. Aiweekly
  44. Defend
  45. Youtube
  46. Securityboulevard
  47. Hacklido
  48. Bleepingcomputer
  49. Youtube
  50. Shieldworkz
  51. Ground
  52. Radar
  53. Cyber
  54. helpnetsecurity.com — Open-source CI/CD abuse detector guards against stolen credential attacks
  55. Github
  56. Socdefenders
  57. Letsdatascience
  58. Sysdig
  59. Akeyless
  60. bleepingcomputer.com — Infinite Campus data breach affects 137,000 school staff accounts
  61. techjacksolutions.com — University of Nottingham Hacked, Over 450,000 Students Affected
  62. Dexpose
  63. Haveibeenpwned
  64. Mpamag
  65. Content
  66. Futureproof
  67. bleepingcomputer.com — iRhythm discloses data breach, says hackers stole patient info
  68. Industrial Cyber — Novo Nordisk faces unauthorized IT access, highlighting persistent threats to pharmaceutical infrastructure
  69. techjacksolutions.com — iRhythm Healthcare Data Breach Exposes Protected Health Information via Third-Party Applications
  70. Cloudstoragesecurity
  71. Cloudsecurityalliance
  72. Clearpoint
  73. Blog
  74. Businessinsights
  75. Nhimg
  76. Blackfog
  77. Security Affairs — iRhythm Hit by Cyberattack, Patient Data Stolen and Ransom Demanded
  78. Malware News — Captured Logs Reveal Hackers Using Claude and Codex to Breach Companies
  79. Paulweiss
  80. Coder
  81. Reddit
  82. Trufflesecurity
  83. Hiddenlayer
  84. Stocktitan
  85. Malwarebytes
  86. Fiercebiotech
  87. Irhythmtech
  88. Mddionline
  89. bleepingcomputer.com — Kodak confirms data breach claimed by ShinyHunters extortion gang
  90. reliaquest.com — Klue Integration Abused in Salesforce Data Theft
  91. cyberinsider.com — Canada introduces privacy law with GDPR-like penalties for data breaches
  92. Safestate
  93. Techdigest
  94. Hackyourmom
  95. Malwarebytes
  96. Futureproof
  97. Techradar
  98. Darkreading
  99. Nysportsday
  100. Frontofficesports
  101. 404media
  102. Classactionu
  103. Sportskeeda
  104. Fadeawayworld
  105. Reddit
  106. Youtube
  107. Dexpose
  108. Dexpose
  109. Thetab
  110. Bleepingcomputer
  111. Reddit
  112. Huntress
  113. Secpod
  114. Securityboulevard
  115. Malwarebytes
  116. Techjacksolutions
  117. Computing
  118. Ransomware
  119. Secureworld
  120. Bankinfosecurity
  121. cybelangel.com — What the Coverage Is Getting Wrong: The Novo Nordisk Breach Started in a JavaScript File, Not GitHub
  122. Fiercepharma
  123. Securitypointbreak
  124. Isssource
  125. Insurancejournal
  126. Mexc
  127. Briefs
  128. Pharmaphorum
  129. Endpoints
  130. Privacyguides
  131. SecurityWeek — Iranian Cyber Group Handala Claims Cal Water Hack
  132. SecurityWeek — Kodak Admits Data Breach After ShinyHunters Hack Claims
  133. Dark Reading — Novo Nordisk Breach Exposes Software Development Pipeline Risk
LINK COPIED TO CLIPBOARD