The DentaQuest breach, 15 million medical records, including children's Social Security numbers

The article on the Aura hack introduced the group ShinyHunters over a leak of 900,000 records. A few months earlier, the same group had already claimed the year's largest healthcare breach, at DentaQuest, a US dental insurer, at a very different scale and with very different data.

What happened

Attackers gained access to DentaQuest's network, the second-largest dental insurer in the United States, between May 17 and 20, 2026, an intrusion discovered on May 20. The company only published a public notification in July, without initially specifying how many people were affected. Later estimates put the number affected at more than 15 million, with some analyses citing over 23 million. The group ShinyHunters claimed the attack, saying it had exfiltrated about 234 GB of data, published on its leak site after ransom negotiations failed.

The exposed data, particularly sensitive

The stolen information included names, addresses, Social Security numbers, member numbers, Medicaid and Medicare numbers, the names of the insurance plans involved, as well as diagnosis, treatment, and billing details. Medical data or a national ID number carries a different kind of severity than a simple password: unlike a password (see the dedicated article), you can't "change" a Social Security number or a medical history once it's leaked, which makes this kind of data exploitable for identity theft or insurance fraud for a long time, well after the breach is first discovered.

The most alarming detail: children's Social Security numbers

Researchers who analyzed the published data identified a file containing more than 1.7 million Social Security numbers, a large share of which appear to belong to children. This detail makes the breach especially serious for a specific reason: a child's Social Security number is almost never used or checked for many years, which means identity theft committed with that number can stay completely invisible for years, until that child, now an adult, tries to open their first bank account or their first line of credit, and discovers a fraudulent history already exists under their name. This is a form of identity theft particularly hard to catch early, precisely because the victim themselves has no idea for a long time that their identity has already been used.

The same group as the Aura breach

The fact that ShinyHunters claimed both this breach and Aura's, a few months apart, illustrates a phenomenon already glimpsed with the Klue breach: a small number of organized cybercriminal groups sit behind a disproportionate share of the major breaches that make headlines, always following the same repeated pattern: intrusion, exfiltration, ransom demand, then publication if refused. Recognizing this pattern helps make sense of these incidents as not isolated, unpredictable events, but the repeated activity of a limited number of identified actors, simply switching targets.

What this actually changes

For the people directly affected, DentaQuest offered 24 months of credit monitoring and identity-theft assistance, a now-standard response after this kind of incident, but one that only covers a limited window against an ID number that stays valid for an entire lifetime. For parents in particular, this incident is a reminder that a child can become a victim of identity theft long before having any financial activity of their own, which makes monitoring worth considering far earlier than people naturally assume, rather than only once that young adult opens their first account.