Cybercriminals Hit Two California Dental Practices
Data security incidents have recently been announced by Santa Barbara Endodontics & Hollister Family Dental & Implant Center in California, and Park Dental Partners in Minnesota.
Santa Barbara Endodontics
Santa Barbara Endodontics, an endodontics-focused dental practice in California, has notified patients that it recently fell victim to a ransomware attack in which patient records were likely stolen. According to its November 7, 2026, data breach notice, the intrusion was identified on October 8, 2026, when the practice received a ransom note. The practice confirmed that patient records had been encrypted, and an investigation into the attack is ongoing. At present, the practice has not determined the extent to which patient data was involved, nor when the ransomware group first accessed its network.
The practice has confirmed that it was able to restore the affected records from backups without paying the ransom and has warned patients that their protected health information may have been stolen. The impacted data includes names, Social Security Numbers (if provided to the practice), medical/dental histories, mental/physical condition information, endodontic treatment or diagnosis information, insurance information, and information relating to past claims for payments for its services.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
The practice has engaged an external cybersecurity firm to assist with the investigation, has notified law enforcement, and is reviewing its security policies, procedures, and practices. The practice confirmed that it is aware of the threat actor’s (The Gentlemen) threats to publish the stolen data and that its cybersecurity partner is monitoring for any release of patient data. The affected individuals have been offered 12 months of complimentary credit monitoring and identity theft protection services and have been advised to monitor their accounts and explanation of benefits statements for signs of data misuse.
Hollister Family Dental & Implant Center
Hollister Family Dental & Implant Center in California has started notifying patients about a recent cybersecurity incident involving its third-party appointment management system. The practice was alerted about an issue with the platform on May 8, 2026, and immediate action was taken to secure the system. The forensic investigation confirmed that the platform was accessed by an unauthorized third party intermittently between February 12, 2026, and May 8, 2026.
During that time, patient data may have been viewed or acquired, including names, contact information, dates of birth, and information related to dental care, including appointment information, questions, providers, symptoms, and medications. No misuse of the exposed information has been identified; however, as a precaution, the affected individuals have been offered complimentary credit monitoring and identity theft protection services for 2 years. The number of affected individuals has not yet been publicly disclosed.
Park Dental Partners
Park Dental Partners, Inc., a Roseville, Minnesota-based dental resource organization that provides business support services and equipment to dental practices in Minnesota, Wisconsin, Arizona, and North Carolina, has started notifying individuals affected by an August cybersecurity incident. According to its notification letters, an unauthorized third party accessed its network between August 26, 2026, and August 27, 2026.
The review of the exposed data was completed on October 7, 2026, when it was confirmed that full names, dates of birth, diagnoses, treatment information, and health insurance policy information were potentially viewed or obtained. The number of affected individuals has yet to be publicly disclosed.
