---
title: "DentaQuest network data incident"
description: "Evidence-backed account of DentaQuest network data incident, covering what happened, impact, timeline, attack vector, technical details, and primary sources."
incident_type: "Data incident"
status: "active"
last_modified: "2026-08-09"
canonical_url: "https://www.ally.security/incidents/dentaquest-network-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/dentaquest-network-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/dentaquest-network-data-incident-2026/stix.json"
---

# DentaQuest network data incident

Unauthorized access to data on DentaQuest's computer network between May 17 and May 20, 2026. Personal-identification, benefits, dental, and vision information accessed during the DentaQuest incident.

Last modified Aug 9, 2026 · 3 sources

## Summary

- **Environment:** Date DentaQuest discovered unauthorized individuals had accessed network data.
- **Operational impact:** No outage or recovery duration quantified
- **Financial impact:** No public cost estimate

## What happened

Unauthorized access to data on [DentaQuest](https://www.dentaquest.com/)'s computer network between May 17 and May 20, 2026. [2](#source-2) [3](#source-3)

## Impact

Personal-identification, benefits, dental, and vision information accessed during the DentaQuest incident. [1](#source-1) [2](#source-2)

Documented data types include:

- Patient account numbers — Member identification numbers; affected fields varied by individual and the review remained ongoing. [1](#source-1) [2](#source-2)
- Dates of birth — Dates of birth reported in Texas Attorney General report BR-0005182; affected fields varied by individual. [1](#source-1) [2](#source-2)
- Clinical information — Dental or vision information including provider name, diagnosis, treatment, and billing information; affected fields varied by individual. [1](#source-1) [2](#source-2)
- Social Security numbers — Social Security numbers; affected fields varied by individual and the review remained ongoing. [1](#source-1) [2](#source-2)
- Contact information — Addresses; affected fields varied by individual and the review remained ongoing. [1](#source-1) [2](#source-2)
- Names — Names; affected fields varied by individual and the review remained ongoing. [1](#source-1) [2](#source-2)
- Health insurance information — Medicaid numbers, Medicare numbers, and other health-plan information; affected fields varied by individual. [1](#source-1) [2](#source-2)

A cited record reports 3,973,000 individuals (Texas residents in report BR-0005182; a subset of the overall reported count and not additive; as of 2026-07-17). [1](#source-1) [2](#source-2)

A cited record reports 15,000,000 individuals (Overall individuals affected as reported in Texas Attorney General report BR-0005182; regulator-reported and not independently verified; as of 2026-07-17). [1](#source-1) [2](#source-2)

The incident affected certain personal information for some DentaQuest members, providers, and other connected individuals. [2](#source-2)

## Timeline

### May 17, 2026 — Activity began

Beginning of the unauthorized-access window determined by DentaQuest's investigation. [2](#source-2)

### May 20, 2026 — Documented activity ended

DentaQuest said the incident ended by May 20, 2026. [2](#source-2)

### May 20, 2026 — Discovery

Date DentaQuest discovered unauthorized individuals had accessed network data. [2](#source-2)

### July 16, 2026 — Public disclosure

Date of DentaQuest's public substitute notice. [2](#source-2)

### July 17, 2026 — Public disclosure

Date DentaQuest said individual incident notifications would begin to issue. [2](#source-2)

### August 9, 2026 — Briefing updated

This briefing was last reviewed and updated on August 9, 2026.

## Threat Group & Attack Vector

The cited public record does not establish a specific initial-access vector, malware family, exploited vulnerability, or ATT\&CK technique.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

DentaQuest said it enhanced security and monitoring controls and provided additional employee training after the incident. DentaQuest said it immediately secured the network, notified law enforcement, and engaged independent cybersecurity experts to investigate. DentaQuest offered affected individuals 24 months of Kroll identity monitoring at no charge, including credit monitoring, fraud consultation, and identity-theft restoration. No access path, attribution, scale, or recovery detail is inferred beyond the cited claims. [2](#source-2)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/dentaquest-network-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Data Security Breach Reports — 2026 public records

regulatory · Office of the Attorney General of Texas

<https://www.texasattorneygeneral.gov/consumer-protection/data-breach-reporting>

<a id="source-2"></a>

### Notice of Data Breach

official · DentaQuest LLC · Jul 16, 2026

<https://www.dentaquest.com/en/notice-of-data-breach>

<a id="source-3"></a>

### Notice of Data Security Incident — DentaQuest

official · Clever Care Health Plan · Jul 16, 2026

<https://clevercarehealthplan.com/notice-of-data-security-incident-dentaquest-2026/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Ended At · 100% confidence · current**  
   May 2026 DentaQuest network intrusion: 2026-05-20
2. **Resulted In · 100% confidence · current**  
   DentaQuest personal and health-data exposure: The incident affected certain personal information for some DentaQuest members, providers, and other connected individuals.
3. **Affected Organization · 95% confidence · current**  
   DentaQuest personal and health-data exposure: Clever Care Health Plan
4. **Resulted In · 100% confidence · current**  
   May 2026 DentaQuest network intrusion: DentaQuest said it enhanced security and monitoring controls and provided additional employee training after the incident.
5. **Resulted In · 100% confidence · current**  
   May 2026 DentaQuest network intrusion: DentaQuest personal and health-data exposure
6. **Resulted In · 100% confidence · current**  
   May 2026 DentaQuest network intrusion: DentaQuest said it immediately secured the network, notified law enforcement, and engaged independent cybersecurity experts to investigate.
7. **Disclosed At · 100% confidence · current**  
   DentaQuest public and individual notifications: 2026-07-16
8. **Resulted In · 100% confidence · current**  
   May 2026 DentaQuest network intrusion: DentaQuest public and individual notifications
9. **Exposed Data Category · 100% confidence · current**  
   DentaQuest personal and health-data exposure: Patient account numbers
10. **Exposed Data Category · 100% confidence · current**  
   DentaQuest personal and health-data exposure: Dates of birth
11. **Affected Individual Count · 100% confidence · current**  
   DentaQuest personal and health-data exposure: 3,973,000 individual
12. **Exposed Data Category · 100% confidence · current**  
   DentaQuest personal and health-data exposure: Clinical information
13. **Discovered At · 100% confidence · current**  
   May 2026 DentaQuest network intrusion: 2026-05-20
14. **Processor For · 100% confidence · current**  
   DentaQuest LLC: Clever Care Health Plan
15. **Exposed Data Category · 100% confidence · current**  
   DentaQuest personal and health-data exposure: Social Security numbers
16. **Affected Organization · 100% confidence · current**  
   May 2026 DentaQuest network intrusion: DentaQuest LLC
17. **Exposed Data Category · 100% confidence · current**  
   DentaQuest personal and health-data exposure: Contact information
18. **Disclosed At · 100% confidence · current**  
   DentaQuest public and individual notifications: 2026-07-17
19. **Exposed Data Category · 100% confidence · current**  
   DentaQuest personal and health-data exposure: Names
20. **Resulted In · 100% confidence · current**  
   DentaQuest public and individual notifications: DentaQuest offered affected individuals 24 months of Kroll identity monitoring at no charge, including credit monitoring, fraud consultation, and identity-theft restoration.
21. **Affected Individual Count · 100% confidence · current**  
   DentaQuest personal and health-data exposure: 15,000,000 individual
22. **Exposed Data Category · 100% confidence · current**  
   DentaQuest personal and health-data exposure: Health insurance information
23. **Began At · 100% confidence · current**  
   May 2026 DentaQuest network intrusion: 2026-05-17

</details>