DentaQuest breach exposes health data of at least 15 million people

DentaQuest, a major dental and vision benefits administrator and subsidiary of Sun Life, has reported a massive cyberattack that exposed the sensitive information of at least 15 million people. The breach, which occurred between May 17 and May 20, 2026, is on track to be the largest healthcare data breach reported to federal regulators this year.

The compromised data includes highly sensitive identifiers such as Social Security numbers, Medicaid and Medicare numbers, and government-issued identification. Additionally, the breach exposed personal details like names, addresses, dates of birth, and dental or vision health information, including diagnoses, treatment details, and billing data. Some estimates suggest the number of affected individuals could reach as high as 23.4 million.

DentaQuest has engaged the firm Kroll to conduct a forensic review and determine the full extent of the compromise. The company has begun notifying affected individuals, noting that the stolen information includes permanent identifiers that cannot be easily changed, such as government program numbers.