Your Dental Practice Is a Ransomware Target. The Breach Data Proves It.

15 breaches

Dental practice incidents tracked in 2025

173K patients

Chord Specialty Dental Partners — single 2025 incident

135K patients

Community Dental Care (MN) — disclosed March 2025

$3.3M settlement

Absolute Dental class action, 2025

2025 Was a Bloodbath for Dental Data

Small dental practices operate under a persistent assumption: they are too small to be worth attacking. There is nothing valuable enough to justify the effort. Ransomware groups target hospitals and health systems, not a two-dentist office in a strip mall.

The 2025 breach record demolishes that assumption. Becker’s Dental Review tracked at least fifteen dental data breaches impacting U.S. practices during 2025 alone — a list that runs from solo pediatric offices in Utah to regional dental groups with six-figure patient counts. A specialty dental partnership in Nashville disclosed a data security incident affecting more than 173,000 people. Minnesota’s largest nonprofit Medicaid dental practice notified nearly 135,000 patients of a December 2024 breach. A California oral and maxillofacial surgery provider was hit by the SafePay ransomware group in July 2025. A Las Vegas dental group paid $3.3 million to settle class action litigation over its breach handling. And moving into 2026, regional IT providers are already reporting active ransomware targeting of dental practices in their markets.

The size of the practice did not determine whether it was targeted. The weakness of the security posture did. And the attack volume is accelerating, not slowing.

What Dental Records Are Worth

PHI sells differently than credit card data. A stolen credit card number is worth roughly $5 to $15 on criminal markets before it gets canceled. A complete dental record — insurance ID, Social Security number, date of birth, treatment history, billing data, and often employer information — retains its value indefinitely. You cannot cancel your SSN.

Dental offices typically hold all of it. Treatment records are tied to insurance claims, which require full identifying information. Orthodontic and cosmetic practices frequently collect financial information directly. Pediatric dentists hold records for children, a data category that is especially valuable because it takes years before anyone notices the fraud.

Beyond the resale value, dental offices are attractive ransomware targets because operational downtime is immediately felt. A practice that cannot access patient records, appointment scheduling, and billing systems cannot function. The pressure to pay and restore operations is real and time-sensitive. Ransomware operators understand this calculus.

What attackers know about dental offices: Small staff, limited IT support, heavy reliance on third-party practice management software, and no dedicated security personnel. The attack surface is well understood. The security posture is predictably weak.

Community Dental Care: 134,903 Patients, Disclosed March 2025

Community Dental Care is Minnesota’s largest nonprofit Medicaid dental practice, operating five clinic locations across the state and treating patients who rely on public dental insurance programs. In December 2024, its network was compromised. In March 2025, the organization filed breach notification paperwork with the U.S. Department of Health and Human Services covering 134,903 individuals — and began mailing notifications to those affected.

The information exposed ranged across the full spectrum of what a dental clinic holds on its patients: medical and dental records, insurance information, Social Security numbers, and in some cases passport numbers. That data set is typical of what dental practices collect in the normal course of Medicaid billing and new-patient intake. The breach involved a network server, which is consistent with either a direct intrusion or a ransomware-style deployment against the file storage and electronic health record environment.

Community Dental Care is not a solo practice tucked into a strip mall. It is a multi-site nonprofit serving a vulnerable population, and it took approximately three months from the December incident to the March 2025 notification. For dental practice owners, that lag is worth absorbing: even organizations with some operational sophistication need months to investigate, reconstruct what happened, and produce defensible notifications. A practice with no documented incident response plan is starting that clock from zero, under pressure, while patients are already asking questions.

Chord Specialty Dental Partners: 173,000+ Patients

Chord Specialty Dental Partners, a Nashville-based dental support organization that operates and services specialty dental practices across multiple states, disclosed a 2025 data security incident affecting more than 173,000 individuals. The organization’s breach disclosure placed this among the largest U.S. dental-sector incidents of the year.

Chord is a dental services organization — a DSO — which makes its risk profile representative of a category that now backstops much of the U.S. dental market. When a DSO is breached, the impact ripples across every affiliated practice that uses its billing, scheduling, or practice management infrastructure. A single solo dentist may have no direct relationship with Chord, but if the practice they joined as a partner uses Chord-operated systems, their patients’ PHI is in the Chord environment whether they realize it or not.

The lesson is about where PHI actually lives. Dental practice owners who ask “is my patient data secure?” often assume the question is about their own workstations and their own internet connection. For any practice affiliated with a DSO, the real answer involves infrastructure the practice does not control and cannot independently audit. That is a supply chain risk, and BAA paperwork alone does not close it.

Your security posture is only as strong as the weakest vendor — or DSO — with access to your patient data. Most dental practices have no idea how many entities that actually is.

Tieu Dental Corporation: SafePay Ransomware, July 2025

Tieu Dental Corporation, a California-based oral and maxillofacial surgery provider, identified an intrusion on July 29, 2025. According to the organization’s breach disclosure, an unauthorized third party accessed its network between July 28 and July 29, 2025. The SafePay ransomware group subsequently claimed responsibility for the attack on its public leak infrastructure.

SafePay is one of several ransomware operations that have targeted U.S. healthcare providers in 2024 and 2025, and the group’s participation in the Tieu Dental incident illustrates a broader trend: ransomware operators now treat specialty dental practices as within scope. Oral surgery providers hold a particularly rich data set — insurance information, Social Security numbers, medical histories that overlap with general healthcare, imaging, and surgical records — which drives up both the resale value of stolen data and the operational leverage an attacker has when they encrypt the environment.

A ransomware incident at a practice the size of Tieu Dental is not a detection failure at the perimeter alone. It is almost always a combination of factors: unpatched systems, weak authentication on remote access, no segmentation between administrative and clinical networks, and no meaningful monitoring of what is happening inside the environment after the initial foothold. None of that is exotic. It is the predictable outcome when a practice runs on a patchwork of IT support without a documented security program.

Absolute Dental: $3.3 Million Class Action Settlement, 2025

Absolute Dental, a Las Vegas-based multi-location dental group, agreed in 2025 to a $3.3 million class action settlement tied to a data breach affecting its patients. The settlement pool was established to resolve claims from individuals whose personal and health information was exposed in the incident. Becker’s Dental Review, which tracks dental-sector enforcement and litigation, listed Absolute Dental as one of fifteen notable dental data breaches during 2025.

Dental practice owners often focus on the regulatory side of breach exposure — the HIPAA Security Rule, the OCR portal, the possibility of a resolution agreement with HHS. Class action litigation is a separate and, in recent years, often larger category of cost. Plaintiffs’ firms now routinely file class actions within weeks of a covered entity disclosing a breach. Settlement negotiations proceed on a parallel track from any OCR investigation. The combined financial exposure — OCR civil monetary penalties, state attorney general action, class action settlement, and the cost of providing credit monitoring and notification services — can easily exceed the cost of the security program that would have prevented the breach in the first place.

The $3.3 million figure is not an outlier. It is within the normal range for class action settlements involving healthcare breaches of this size. And it is being paid by a practice group that presumably carries cyber liability insurance — which means the insurance market has now absorbed enough dental-sector losses that coverage terms, deductibles, and exclusions are tightening across the industry.

The 2025 Pattern Across Smaller Practices

Beyond these anchor cases, the 2025 breach record is populated with mid-sized and small practices in ways that should concern every dental practice owner reading this. A partial list from the year:

West Texas Oral Facial Surgery (Lubbock): data breach affecting more than 11,000 individuals.
Rinehart Dentistry (Georgetown, South Carolina): data breach affecting approximately 25,000 individuals.
Upper Dublin Family Dentistry (Willow Grove, Pennsylvania): data breach affecting roughly 5,000 individuals.
Olde Towne Medical and Dental Center (Williamsburg, Virginia): ransomware incident affecting approximately 2,567 individuals.
32 Pearls (Seattle / University Place, Washington): data breach affecting 23,517 individuals.
Dr. Doug’s Pediatric Dentistry (Logan, Utah): data security incident at a pediatric practice — a category where exposed records retain fraud value for years before minors become adults.
Minnesota Orthodontics and Dentofacial Orthopedics: hacking incident affecting approximately 500 individuals, the HIPAA large-breach threshold.
Dentistry.One (subsidiary of teledentistry vendor Mouthwatch), Delta Dental of Virginia, Greater St. Louis Oral & Maxillofacial Surgery, Artistic Family Dental (Illinois): all disclosed 2025 data security incidents.

None of these are enterprise-scale healthcare organizations. They are the exact profile of practice that tells itself, routinely, that it is too small to be a target. The 2025 data says otherwise, loudly and with documentation.

Heading Into 2026: Regional Targeting Is Already Active

The trend does not appear to be reversing in 2026. Regional managed service providers serving dental practices have already begun publishing advisories about ransomware operators actively targeting dental offices in specific geographic markets — including advisories from IT providers in the West Chester, Pennsylvania area describing ongoing targeting of local dental practices in early 2026. Healthcare-wide, analysts are projecting a 36 percent increase in ransomware activity against the sector in 2026, with data theft now occurring in 96 percent of incidents before any encryption is triggered.

For dental practice owners, that has a practical implication. A ransomware event today is presumed by OCR to be a reportable breach unless the practice can affirmatively demonstrate that PHI was not accessed. Given how attackers now work — exfiltrate first, encrypt second — the “no breach occurred” defense is increasingly difficult to sustain. The default assumption in an OCR investigation will be that data left the environment, and the burden will fall on the practice to prove otherwise using logging, monitoring, and forensic evidence that most practices do not have.

The pattern across the 2025 cases: Ransomware, vendor and DSO exposure, class action litigation, and disclosure delays all appear in the record — across practices of every size. Dental practices are not failing at one thing. They are failing across the board because most have never built a security and compliance program, and 2025 was the year the attack economy caught up with that gap.

Why Dental Is Structurally Vulnerable

The dental sector has several characteristics that compound security risk in ways that are structural, not incidental.

High vendor dependency. Dental practices run on practice management software, billing clearinghouses, imaging systems, patient communication platforms, and insurance networks. Each of these is a third-party system that holds or processes PHI. The average dental office has more vendor connections than most small businesses in any other sector. Each connection is a potential breach vector.

No dedicated IT or security staff. Most dental practices rely on a single IT vendor or managed service provider — if they have any external IT support at all. There is no security team, no CISO, no dedicated compliance officer. The office manager handles HIPAA training. Nobody is monitoring logs, reviewing vendor contracts for security provisions, or running risk assessments.

PHI that is current and complete. Unlike some healthcare settings where records may be partial, dental records in a practice management system are typically current, complete, and directly tied to insurance billing data. The data quality is high, which means the value to attackers is high.

Underinvestment in security infrastructure. Security spending in dental practices is minimal. Endpoint protection is often consumer-grade. Backup systems, when they exist, are frequently untested. Monitoring of administrative access and data egress is almost universally absent. These conditions are what allow a SafePay-class intrusion to move from initial foothold to full environment compromise in under 48 hours — the window observed in the Tieu Dental incident — without any of the practice’s existing tools registering the activity as suspicious.

What a Defensible Security Posture Looks Like for a Dental Practice

HIPAA does not require perfection. It requires a documented, risk-based security program that is appropriate to the size and complexity of the practice. For a small dental practice, that is achievable. It is not cheap in time or attention, but it is not enterprise-scale either.

Conduct a written HIPAA Security Risk Analysis — not a checklist, an actual analysis of where PHI lives, who can access it, and what the realistic threats are. This is the foundational requirement that was absent in almost every enforcement case above.
Document your policies and procedures. They do not need to be complex. They need to exist, be accurate, and be reviewed annually.
Inventory every vendor that touches PHI and confirm you have a signed Business Associate Agreement with each one. Review those BAAs to confirm they include breach notification obligations.
Ask your vendors direct questions about their security practices: Where is data stored? Who has access? What encryption is in place? When was the last penetration test? A vendor that cannot answer these questions is a risk you need to evaluate.
Configure multi-factor authentication on every system that holds PHI — your practice management software, your email, your billing portal, your imaging system.
Test your backups. A backup that has never been tested is not a backup. It is a file that may or may not be restorable under pressure.
Train your staff on phishing, social media disclosure, and what to do if they think something is wrong. A large share of 2025 dental breaches were not sophisticated technical exploits — they were opportunistic intrusions that credentialed a staff account and walked in the front door.
Build a breach response plan before you need it. Know who you call, what you preserve, and what the 60-day notification clock means for your obligations.

The Leadership Reality

Dentists are not IT professionals and should not have to be. But the HIPAA Security Rule does not have an exemption for practices where the owner would rather focus on patient care. The regulatory framework applies regardless of staff size, technical sophistication, or how recently the practice manager attended a compliance webinar.

What the 2025 enforcement and litigation record shows is that OCR, state attorneys general, and plaintiffs’ class action firms are actively pursuing dental practices — not just hospitals, not just health systems. The combination of documented compliance failures, breach events, class action exposure, and notification-timeline challenges produces multi-front liability that is difficult to resolve cheaply.

Community Dental Care, Chord Specialty Dental Partners, and Absolute Dental involved organizational resources that solo practices and small groups do not have. But Tieu Dental, Rinehart Dentistry, Upper Dublin Family Dentistry, Olde Towne’s ransomware incident, and the pediatric-practice breach in Utah — those are the patterns that apply directly to the practices seeing patients today in smaller markets. The exposure is real. The enforcement and litigation records are real. And the cost of building a defensible security program is substantially lower than the cost of defending against it after the fact.

Security Medic Consulting Works with Dental and Healthcare Practices

Security Medic Consulting provides Fractional CISO services, HIPAA Security Risk Analyses, and vendor risk assessments for healthcare practices that need a defensible security program without the overhead of a full-time security team. If you are a dental practice owner who is not certain your compliance posture would survive an OCR investigation, that is the right place to start the conversation.

Talk to a Fractional CISO

Sources and References

Becker’s Dental Review. (2025). 15 data breaches that impacted dentistry in 2025. beckersdental.com
GovInfoSecurity. (2025). Minnesota Dental Clinic Notifying 135,000 of 2024 Hack. govinfosecurity.com
HIPAA Journal. (2025). California Dental Care Provider Announces Data Breach (Tieu Dental Corporation / SafePay). hipaajournal.com
U.S. Department of Health & Human Services, Office for Civil Rights. (n.d.). Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information. ocrportal.hhs.gov
TechTarget Healthtech Security. (2025). 10 largest healthcare data breaches reported to OCR in 2025. techtarget.com
The HIPAA Guide. (2025). Biggest Healthcare Data Breaches in H1 2025. hipaaguide.net
HIPAA Journal. (2026). Healthcare Data Breach Statistics — Updated for 2026. hipaajournal.com
American Hospital Association. (2025, October 7). 2025 Cybersecurity Year in Review, Part One: Breaches and Defensive Measures. aha.org
Titan Tech. (2026, April). Ransomware Operators Are Targeting West Chester Dental Practices — Here’s Why. titan.tech
American Dental Association. (n.d.). Protect Your Practice from Ransomware. ada.org
U.S. Department of Health & Human Services, Office for Civil Rights. (n.d.). HIPAA Breach Notification Rule. hhs.gov
U.S. Department of Health & Human Services, Office for Civil Rights. (n.d.). Resolution Agreements and Civil Monetary Penalties. hhs.gov