DentaQuest cyberattack exposes 2.6M accounts publicly

DentaQuest cyberattack – DentaQuest, part of Sun Life and a major dental benefits manager, confirmed an unauthorized-access incident affecting a limited portion of its network. A public leak listing says data tied to 2.6 million unique email addresses was exposed, including names, pho

For DentaQuest customers, the fear arrived before the answers. A public breach listing tied to the dental benefits provider says data for 2.6 million unique accounts has surfaced online—complete with identifiers and health insurance details that can turn everyday information into a target.

DentaQuest has confirmed a cybersecurity incident involving unauthorized access to a limited portion of its network. In a company update. it said it was “actively managing a cybersecurity incident involving unauthorized access to a limited portion of our network. ” while its investigation was still ongoing.

The company said it took immediate steps to secure its environment, contain the attack, and mitigate the threat. “Our systems remain fully operational, and we continue to serve our clients with limited disruption,” DentaQuest said.

Even as the company works through the incident, the leak itself is moving fast. Have I Been Pwned listed the breach on June 3 and said the incident occurred in May 2026. The breach notification service said the exposed dataset included 2.6 million unique email addresses. along with names. addresses. phone numbers. dates of birth. genders. government-issued IDs. and health insurance information.

Have I Been Pwned also said that about 66% of the exposed records had appeared in its database from previous breaches affecting other organizations and services.

DentaQuest has not publicly confirmed the 2.6 million figure or the full set of affected data elements identified by Have I Been Pwned. The company said it was still working to determine the exact scope of the incident—specifically the nature and extent of any data that may have been compromised.

The public listing of DentaQuest’s data traces back to a claim on a data leak site. BleepingComputer reported that the incident surfaced after ShinyHunters listed DentaQuest on its data leak site and claimed to have stolen more than 234 GB of data. That report also said the data was later publicly leaked after the threat actor claimed negotiations failed.

DentaQuest’s response is now split between service continuity and investigation. The company says it is working with a cybersecurity expert, forensic investigators, and law enforcement authorities. It also described its current operations: it says it serves 35 million customers. operates programs in 50 states. and works with a network of 140. 000 dentists and dental specialists.

DentaQuest is part of Sun Life and manages dental insurance plans and provider networks for Medicaid programs, Medicare Advantage plans, employers, health plans, and individual customers.

The hardest part for affected people may be the gap between what the leak site claims and what DentaQuest can confirm. Unauthorized access is acknowledged—but the company hasn’t yet disclosed how many individuals may ultimately be affected or which specific information was accessed.

The situation also sits inside a broader reality for healthcare data: the leak listing’s claim that roughly 66% of the exposed records came from previous breaches means many of these details may already be somewhere else online. Still, having them bundled together with health insurance information is its own kind of risk.

DentaQuest says its systems remain operational, but the questions patients and plan members are left with—who exactly was impacted and what was exposed—are the ones that don’t go away simply because the lights are still on.

DentaQuest Sun Life dental insurance cybersecurity incident data breach ShinyHunters Have I Been Pwned exposed accounts health insurance information government-issued IDs Medicaid Medicare Advantage