Absolute Dental Confirms 1.2 Million Victims in Earlier Data Breach

A filing with the Oregon Attorney General revealed that a data breach at Absolute Dental claimed over 1.2 million victims. Absolute Dental had previously disclosed the data breach with a placeholder figure of just 501 affected individuals to the HHS’ Office for Civil Rights on May 2, 2025.

Absolute Dental first became aware of a possible incident involving its information systems on February 26, 2025. According to them, they launched a third-party investigation into the matter, which confirmed that an unknown third party had obtained unauthorized access to its systems between February 26 and March 5, 2025.

The scope of the breach was not ascertained at that time. It's common practice for healthcare providers to use a substitute figure of 500 or 501 affected individuals and then revise it later. However, we now also know that highly sensitive data was stolen, including patients’ contact information, dates of birth, Social Security numbers, ID details, and health histories. Financial and payment card info was also exposed for a small subset of the victims.

The forensic investigation revealed a sophisticated supply chain attack in which the hackers somehow managed to leverage an account associated with one of Absolute Dental’s managed service providers. They used this access to execute a malicious version of a legitimate software tool, likely bypassing threat detection systems.

According to HIPAA Journal, Absolute Dental has reported the breach to regulators as well as notified law enforcement and those impacted by the breach. Victims are also being offered complimentary credit monitoring services for two years, as is common in these types of incidents.

Absolute Dental is a prominent dental practice spanning 50+ locations across Nevada in Las Vegas, Carson City, Reno, and other cities.

In other health-related news, Meta was found guilty of collecting women’s health data without their consent via a third-party app. This is not the only major cybersecurity incident to hit the state of Nevada this month. Hackers stole data from the State of Nevada in a ransomware-based attack that also impacted public infrastructure.