DentaQuest Data Breach Analysis: ShinyHunters Leak Exposes PII and PHI of 2.6 Million Members in 2026 – Rescana
Cybersecurity Incident Analysis
Jun 7, 2026
7 min read
← All posts
DentaQuest Data Breach Analysis: ShinyHunters Leak Exposes PII and PHI of 2.6 Million Members in 2026
Executive Summary<br>In May 2026, DentaQuest , a leading dental and vision benefits administrator serving Medicaid, Medicare Advantage, employers, health plans, and individual customers across all 50 states, experienced a significant data breach. The cybercriminal group ShinyHunters claimed responsibility for the attack, which resulted in the exfiltration and subsequent public leak of over 234 gigabytes of sensitive data. This breach impacted approximately 2.6 million individuals, exposing personally identifiable information (PII) and protected health information (PHI) such as names, dates of birth, email addresses, phone numbers, home addresses, genders, government-issued IDs, health insurance information, and Medicaid IDs. The incident was confirmed by DentaQuest on June 2, 2026, and has since been independently verified by multiple cybersecurity sources. The breach has raised concerns regarding regulatory compliance, particularly due to delayed notification to the U.S. Department of Health and Human Services and state attorney general offices. The exposed data significantly increases the risk of identity theft, fraud, and targeted phishing attacks for affected individuals. This report provides a comprehensive technical analysis of the incident, the tactics used by the threat actor, and actionable recommendations for mitigation and response. Sources: PR Newswire, Have I Been Pwned, BleepingComputer
Technical Information<br>The DentaQuest breach was orchestrated by the ShinyHunters group, a well-known cybercriminal organization specializing in large-scale data theft and extortion. The attack leveraged credential-based access to DentaQuest ’s cloud infrastructure, consistent with ShinyHunters ’ historical tactics. The group typically acquires legitimate credentials through phishing campaigns or by targeting repositories and cloud services for OAuth keys and access tokens. In this incident, there is no evidence of malware deployment; instead, the attackers relied on credential theft and exploitation of cloud accounts to gain unauthorized access and exfiltrate data.<br>Upon gaining access, the attackers exfiltrated over 234 GB of data, which included sensitive PII and PHI. The compromised data was primarily found in healthcare enrollment files (ASC X12 transaction sets), member records, and related files. The breach was publicly disclosed after ShinyHunters failed to extort payment from DentaQuest , leading to the data being posted on the group’s dark web leak site.<br>DentaQuest confirmed the incident on June 2, 2026, stating that the breach involved unauthorized access to a limited portion of its network. The company reported that immediate action was taken to secure the environment, contain the attack, and mitigate the threat. External cybersecurity experts were engaged to assist with the investigation and to determine the scope of the compromised data. Despite these efforts, the breach resulted in the exposure of highly sensitive information for 2.6 million individuals.<br>Technical analysis of the incident aligns with the following MITRE ATT&CK techniques:<br>Initial Access: Phishing for credentials (T1566), Valid Accounts: Cloud Accounts (T1078.004)<br>Credential Access: Steal Application Access Tokens (T1528)<br>Discovery: Cloud Infrastructure Discovery (T1580)<br>Collection: Data from Cloud Storage Object (T1530), Data from Information Repositories (T1213)<br>Exfiltration: Exfiltration Over Web Service (T1567)<br>No malware artifacts, command-and-control infrastructure, or ransomware deployment were identified in this incident, which is consistent with ShinyHunters ’ established modus operandi. The group’s focus on credential-based access and cloud data exfiltration, rather than malware or ransomware, is well-documented in prior incidents involving other high-profile organizations.<br>The breach has significant implications for the healthcare sector, particularly for data aggregators like DentaQuest that manage large volumes of sensitive information. The exposure of PII and PHI not only increases the risk of identity theft and fraud but also raises regulatory concerns due to the delayed notification to authorities. The incident underscores the importance of robust credential management, cloud security controls, and timely breach notification in the healthcare industry.<br>Sources: PR Newswire, Have I Been Pwned, BleepingComputer, Intel 471
Affected Versions & Timeline<br>The breach affected DentaQuest ’s cloud infrastructure and associated data repositories. The incident occurred in May 2026, with public disclosure and confirmation by DentaQuest on June 2, 2026. The compromised data includes records for approximately 2.6 million individuals, with...