For: DentaQuest members, former members and parents of child members in the US, and anyone who runs sign-in, MFA or a help desk for an organization. This article is based on the public sources below and does not cover attack techniques.
- DentaQuest's own notice and letters to affected people
- Its filings with US state attorneys general
- US government guidance (FTC, IRS, Medicare, CISA)
What affected members should do today
Confirm you are affected — use only the number in your letter
DentaQuest began mailing letters on July 17, 2026. Separate versions were filed for adults, minors and deceased individuals. The company also posted the same information on its website for people it could not reach. If you have questions, the dedicated call center is (844) 959-7163, Monday to Friday, 8:00 a.m. to 5:30 p.m. Central Time. Because the data includes phone numbers and addresses, do not trust a call or text that says it is from DentaQuest and asks you to "confirm" your SSN or member ID; call the number printed on your letter instead (see What is phishing?).
Enroll in the free identity monitoring before your deadline
The letter offers 24 months of identity monitoring at no cost, covering credit monitoring, fraud consultation and identity theft restoration. It says you have 90 days from the date the letter was mailed to enroll, using the activation code in the letter. Monitoring tells you after fraud happens; the next step, a credit freeze, is what prevents new accounts from being opened.
Freeze your credit at Equifax, Experian and TransUnion
The FTC says that while a credit freeze is in place, nobody can open a new credit account in your name. It is free, does not affect your credit score, and lasts until you lift it. You must contact all three bureaus separately. When you need credit, you can lift it temporarily at the bureau the lender uses. A fraud alert is a lighter option that asks lenders to verify your identity first; an initial alert lasts one year.
Get an IRS Identity Protection PIN
An IP PIN is a six-digit number that, according to the IRS, prevents someone else from filing a tax return using your SSN. Anyone with an SSN or ITIN who can verify their identity can enroll, even if they do not have to file. The fastest route is your IRS online account. Parents and guardians can also request one for dependents.
Read your Explanation of Benefits and watch your Medicaid or Medicare number
The FTC describes medical identity theft as someone using your name, SSN, health insurance number or Medicare number to get care or submit claims. Warning signs include a bill or Explanation of Benefits for care you did not receive, or a debt collector calling about medical debt you do not owe. If you think someone is using your Medicare number, Medicare says to call 1-800-MEDICARE (1-800-633-4227), and it will never call you uninvited to ask for personal information. For a Medicaid number, the FTC's advice applies: contact the health plan and the providers where your information may have been used and ask for the records. Fraud in Medicare and Medicaid can also be reported to the HHS Office of Inspector General hotline (1-800-HHS-TIPS).
Parents: freeze your child's credit too
DentaQuest filed a separate letter for minors, so children are among the people being notified. The FTC says that if your child is under 16, you can request a free credit freeze in the child's name; it stays in place until you ask the bureaus to remove it, and each bureau has its own process for minors. For an IP PIN for a child under 18, the IRS says you must use one of its alternative enrollment options.
If something is misused, make a recovery plan at IdentityTheft.gov
If you find an account, tax return or medical claim you did not make, report it at IdentityTheft.gov. The FTC site asks what happened and builds a personal recovery plan. DentaQuest's letter also advises contacting your local police if you suspect identity theft.
SSN + name + date of birth
↓→
New credit, fake tax returns
→ Credit freeze at all three bureaus + IRS IP PIN
Medicaid / Medicare / member number
↓→
Care or claims in your name
→ Read every Explanation of Benefits; call 1-800-MEDICARE or your plan
Name + address + provider and diagnosis
↓→
Convincing calls and letters
→ Hang up; call the number on your letter or card
What happened (from DentaQuest's notice and state filings)
Everything below is as stated by DentaQuest in its public notice, its letters to individuals, and its letters to the Washington State Attorney General, or as listed by state regulators.
May 17, 2026
The incident began, according to the company.May 19
According to the Washington filing, all activity by the unauthorized party ended. (The public notice says the incident ended "by May 20".)May 20
DentaQuest became aware of an unauthorized third party claiming to have its data, and put containment measures in place. An outside forensic firm was engaged through outside counsel.May 21
The company informed the FBI.May 26
DentaQuest first published its notice of data breach on its website.May 29
The company learned that the data had been posted on the dark web.July 16–17
Filings with state attorneys general citing more than 15 million people; the company says it also notified the HHS Office for Civil Rights. Letters mailed from July 17.August 3
Updated filing to the Washington AG: more than 27.4 million people nationwide; the review is ongoing.
- Who
- DentaQuest LLC, which works with health plans to provide dental and vision benefits. Affected people include members, providers and others connected to DentaQuest, and people whose plan used to work with it
- Data involved
- Name, address, date of birth, Social Security number, member ID number, health plan number, Medicaid and Medicare numbers, and dental or vision health information (provider name, diagnosis, treatment, billing). Varies by person
- How access happened (Washington filing)
- A social engineering attack tricked a single employee into providing credentials and a multifactor authentication code. Data was taken from a network file share
- What the investigation did not find
- No evidence of other compromised accounts, malware or ransomware, privilege escalation or persistence; operating systems were not affected, according to the filing
- Posted online
- The letters say the individual's information was "accessed and posted on the internet"
- Company measures
- Enhanced security and monitoring controls, additional employee training, outside cybersecurity experts
- Contact
- (844) 959-7163, Mon–Fri 8:00 a.m.–5:30 p.m. Central Time
How to read the numbers
The count has grown as the review continued: more than 15 million in the July 16 filings, more than 27.4 million in the August 3 update, and the company says the review is ongoing. Other figures circulating online come from outside analyses or from the party that took the data; this article uses only the company's own filings. If you are a member and have not received a letter, that alone does not prove you were not included.
Why a code was not enough, and what would have stopped it
The filing does not say which kind of MFA DentaQuest used, and this article does not guess. What it does say is enough for a general lesson: the second factor was something a person could give away.
Factors a person can hand over
- Password (typed, can be read out)
- SMS or app one-time code (six digits, can be read out or typed into the wrong page)
- Push approval (one tap, can be approved for someone else)
Factors bound to the real site
- Passkey (FIDO/WebAuthn, on a phone or computer)
- FIDO2 security key (a physical key)
- PKI smart card (certificate-based)
CISA's guidance ranks MFA from strongest to weakest and calls phishing-resistant MFA "the gold standard". It says the only widely available phishing-resistant form is FIDO/WebAuthn authentication, and it lists one-time-password apps as vulnerable to phishing.
The difference is structural: a passkey or security key checks which website is asking before it answers, so there is no code for a person to read out, and nothing an attacker can capture and enter on the real site. How the options compare for your own accounts is covered in Choosing multi-factor authentication and What is a passkey?.
This site's view: the help desk is part of your MFA
Organizations often roll out passkeys and then leave another way in: the process for resetting them. If someone who calls the help desk saying "I lost my phone" can get a new factor registered after answering questions whose answers are in a leaked file (name, date of birth, employee ID), the strong factor does not actually stop an intruder. Treat the reset process as a login:
- Verify outside the call: hang up and call back on the number in the HR directory, or confirm through the employee's manager on a separate channel.
- Never accept "knowledge" as proof: anything in an HR or member file can leak. Use an in-person check, a video check against the badge photo, or an existing registered device.
- Slow down high-risk resets: a new factor on an admin, finance or help-desk account triggers a notice to the user's other devices and their manager, plus a short hold before it becomes usable.
- Start with the most privileged accounts: put phishing-resistant MFA on administrators, help-desk staff and anyone who can reach bulk data (such as a shared file store) first; CISA urges administrators and other high-value targets to move first.
For organizations that hold member or patient data
The filing says data was taken from a network file share. That detail is worth checking in your own environment, because file shares tend to collect exports and reports that nobody owns.
Find the bulk exports on shared drives
Search file shares and shared cloud folders for spreadsheets and exports that contain SSNs, member IDs or diagnosis codes. For each, ask: who needs this file, and could the same work be done inside the system of record, where access is logged and limited?
Alert on volume, not just on logins
A stolen login that passed MFA looks like a normal login. What stands out is how much one account reads. Set an alert on your file server or cloud storage audit log for one account reading far more files than its usual daily volume, and route it to someone who can suspend the account that day.
Plan the notification before you need it
DentaQuest mailed separate letters for adults, minors and deceased individuals, and its count grew as the data review went on. Decide in advance how you would identify people from a pile of files, and how you would reach people whose contact details are out of date. The broader baseline is in The minimum security baseline for organizations.
For another case where the way in was an employee being deceived, see the Carnival Corporation breach, which also involved passport numbers; for identity-document numbers leaking in Europe, see the Odido breach.
Sources (public record)
The facts in this article come from the public sources below. Figures and claims from the party that took the data, and outside estimates, are not used.
- DentaQuest, Notice of Data Breach (first published May 26, 2026; updated July 16, 2026) — dentaquest.com (archived copy)
- DentaQuest letters to the Washington State Attorney General (July 16, 2026 notice and August 3, 2026 update, with sample letter) — Washington AG breach portal (PDF) / atg.wa.gov
- California Attorney General, DentaQuest LLC breach listing with adult, minor and deceased notification letters — oag.ca.gov
- Oregon Department of Justice, data breach reports (DentaQuest LLC, 15,000,000) — justice.oregon.gov
- FTC, Credit Freezes and Fraud Alerts — consumer.ftc.gov / What To Know About Medical Identity Theft — consumer.ftc.gov / IdentityTheft.gov
- IRS, Get an identity protection PIN — irs.gov
- Medicare, Your Medicare card and Reporting Medicare fraud and abuse — medicare.gov / medicare.gov
- HHS Office of Inspector General, Report Fraud, Waste, and Abuse — oig.hhs.gov
- CISA, Implementing Phishing-Resistant MFA (fact sheet, October 2022) — cisa.gov (PDF)
Update history
2026-10-19: Replaced the duration card with the dates in the official notice, distinguishing the state filing's May 19 end from the notice's by-May-20 wording. Exact elapsed hours are not inferred. The incident log now separates first publication on May 26 from mailings starting July 17. Clarified in the search description, summary and opening that the count is the overall affected population and data elements such as SSNs and insurance numbers vary by individual.
2026-09-30: First version, based on DentaQuest's notice (updated July 16, 2026), its filings with the Washington, California and Oregon regulators (including the August 3, 2026 update of more than 27.4 million people), and FTC, IRS, Medicare, HHS-OIG and CISA guidance. The company says its data review is ongoing; this article will be updated if the count changes.
Read next
- Other health-data cases this year: Aesto Health (health-data archiving) / Medtronic (medical devices)
- Choosing a second factor: Choosing multi-factor authentication / What is a passkey?
- Spotting follow-on scams: What is phishing?
- Another 2026 case that began with a deceived employee: The Carnival Corporation breach (passport numbers)
- ID numbers leaked in Europe: The Odido breach (Netherlands)
- Passwords: Choosing a password manager
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)
- For operators: The minimum security baseline for organizations