Dental data breaches in 2026: what the notices have in common

By late September, Becker's Dental Review had counted 23 dental data breaches reported in 2026. They range from a single-office pediatric practice to groups with a dozen or more locations, and from about 500 patients affected to more than 45,000.

Most breach notices say very little about how the attacker got in. The ones that do say keep pointing at the same few doors. That's useful, because it tells a practice where to look first.

Size doesn't keep you off the list

It's tempting to assume attackers only go after big groups. This year's list says otherwise. Lumio Dental in Jenks, Oklahoma, reported a breach affecting 500 people. Issaqueena Pediatric Dentistry in South Carolina reported a ransomware attack affecting 501. Hawaii Family Dental, with 12 offices, reported 45,853.

For an attacker, a small office with patient records and no one watching the network is a good target, not a small one.

Door one: remote access

Soniva Dental Care, a 14-location group in Texas, reported that a ransomware attack in late May targeted its remote desktop web services. According to ClaimDepot's reporting, the practice's IT provider noticed irregularities with the remote access systems, and a ransomware group later claimed the attack and posted the stolen data.

Remote access is convenient. It's how the doctor checks the schedule from home and how vendors support imaging software. It's also a door that faces the internet, and it gets attacked constantly.

What to check:

• Every remote access tool in your office, including the ones vendors installed years ago
• Multi-factor sign-in on anything reachable from outside the building
• Accounts that belong to people or vendors who no longer need them

Door two: a stolen email account

Hawaii Family Dental reported that someone used a compromised account to reach patient information. HIPAA Journal reported that at Aldrich Pediatric Dentistry in Indianapolis, an employee's email account was compromised after a reply to a phishing email.

Email is where patient information piles up quietly: referral letters, insurance paperwork, x-rays sent to specialists. One stolen password can expose all of it, and the attacker can then send convincing messages to your patients and partners from a real address.

What to check:

• Multi-factor sign-in on every mailbox, including shared ones like the front desk
• Mail filtering that flags lookalike senders and odd attachments
• A habit of reporting strange emails instead of deleting them quietly

Door three: backups in the line of fire

Tampa Bay Dental Implants & Periodontics reported a ransomware incident affecting an internal server that held backups of its electronic medical records. When the backups live on the same network, or the same server, as the data they protect, ransomware can reach both.

What to check:

• At least one copy of your backups kept off-site and out of reach of your office network
• Alerts that reach someone who will act on them
• A real test: restore a chart, open its images and time it

They take the data, not just lock it

Several of this year's incidents were claimed by ransomware groups that posted or threatened to post stolen patient data. That changes the math. A good backup gets your schedule running again, but it can't un-steal records. Prevention and early detection matter as much as recovery.

That's why we put layered protection on every computer we manage, designed to stop as much as possible: email and DNS filtering, SentinelOne with people watching it 24/7, multi-factor sign-in and updates that actually get installed. No single layer catches everything, which is the point of having several.

A short checklist for your next staff meeting

• Who can reach our systems from outside the office, and how?
• Does every mailbox require multi-factor sign-in?
• Where are our backups, and when did we last restore one?
• Who gets security alerts, and what do they do with them?
• Would anyone on staff know who to call if a screen showed a ransom note this morning?

If any answer is "not sure," that's where to start.

Final thoughts

The practices on this year's list aren't careless outliers. Many of them are ordinary offices that had one door open at the wrong time. The good news is that the doors are well known, and closing them doesn't take an enterprise budget.

If you'd like a plain-English look at how your practice handles these three areas, we're glad to help. We support dental practices in Asheville, Hendersonville and across Western North Carolina.

Source / further reading: Becker's Dental Review, "23 dental data breaches in 2026"; ClaimDepot on the Soniva Dental Care breach; HIPAA Journal on cybersecurity incidents at dental practices.