Oregon Dental Practice Reports Two Data Breaches Affecting More Than 31,000 Patients
Data security incidents have been announced by the dental practices Hood River Dental in Oregon and Keep Smiling Dental Group in Ohio, and the multi-state senior living, rehabilitation, and skilled nursing provider Liberty Healthcare Group.
Hood River Dental, Oregon
Hood River Dental, an Oregon dental practice with two locations in Hood River, has recently reported two data security incidents to the HHS’ Office for Civil Rights, one involving unauthorized access to the protected health information of 16,609 individuals, and a second incident affecting 14,677 individuals. The first incident was identified by the practice on or around October 22, 2025. Steps were taken to contain the incident and ensure the security of its systems; then, on or around January 15, 2026, a second security incident occurred. Each incident was investigated, and it was confirmed on September 8, 2026, that in both incidents, patient data had been exposed.
Both incidents involved unauthorized access to similar types of information, which may have included first and last names, dates of birth, financial account information, payment card information, driver’s license numbers, Social Security numbers, medical record numbers, patient ID/account numbers, medical diagnoses, treatment information, and/or health insurance information. The practice said it takes data privacy and security seriously and is enhancing security to prevent similar incidents in the future.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
Liberty Healthcare Group, North Carolina
Liberty Healthcare Group, the operator of senior living communities, nursing homes, and rehab facilities in North Carolina, South Carolina, Virginia, Tennessee, Louisiana, and Florida, is investigating a cybersecurity incident that was first identified on August 7, 2026. The affected systems were isolated, and an investigation was launched to determine the cause of suspicious activity, with assistance provided by third-party cybersecurity experts. While unauthorized access has been confirmed, Liberty Healthcare Group has not yet determined the number of affected individuals. Information compromised in the incident likely includes full names, addresses, birth dates, medical information, and health insurance information.
Notification letters will be mailed to the affected individuals when the data review is completed. The incident has been reported to regulators, and the HHS’ Office for Civil Rights breach portal lists the incident as affecting at least 501 individuals. The total will be updated when the file review is completed.
Keep Smiling Dental Group, Ohio
Keep Smiling Dental Group, a Beavercreek, Ohio-based family dental practice, is alerting patients about a cybersecurity incident that was identified on September 7, 2026, when it experienced a network disruption. An investigation was launched, which confirmed that an unauthorized third party had access to its computer network between August 29, 2026, and September 5, 2026, during which time files containing patient information were accessed or acquired. The affected files were reviewed to determine the individuals affected and types of data involved.
Keep Smiling Dental Group said the impacted information varies from individual to individual and may include names in combination with some or all of the following: address, phone number, email address, date of birth, patient ID, medical histories, dental records (including X-rays, treatment plans, and clinical notes), appointment/schedule information, dental insurance information, and dental account/billing information. A subset of patients also had their Social Security numbers exposed.
Several steps have been taken to improve security to prevent similar incidents in the future, including implementing additional cybersecurity measures, server-side security enhancements, and additional anti-phishing training for the workforce. The number of affected individuals has yet to be publicly disclosed.
