DentaQuest Data Breach: Is There a Settlement? (July 2026 Status)
One of the largest healthcare breaches of 2026: DentaQuest — the largest US Medicaid dental benefits administrator — has revised the toll to more than 23 million people — up from the initially confirmed 15 million — with data stolen, including Social Security numbers and children's records. Notification letters started hitting mailboxes July 17, 2026. Here's the honest status: no settlement exists yet — and here's what you should actually do today.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened — and What the Lawsuit Alleges
Between May 17 and May 20, 2026, intruders accessed DentaQuest's network; the company discovered the attack on May 20. The ShinyHunters extortion group claimed responsibility, demanded a ransom, and — after negotiations failed — published stolen files to the dark web (the group claims roughly 234 GB; that figure is the attackers' own, not independently verified). The pending class actions allege negligence, breach of contract, unjust enrichment, and invasion of privacy: DentaQuest allegedly failed to protect exactly the kind of data (SSNs, Medicaid numbers, children's records) it exists to safeguard.
Case Details
On July 31, 2026 the court CONSOLIDATED the federal class actions under Fed. R. Civ. P. 42(a) — the master case is now In re: DentaQuest Group, Inc. Data Incident Litigation, No. 1:26-cv-12458 (D. Mass., Judge Angel Kelley), with 23 related actions on the docket as of August 21, 2026 (newest: Whitlow, filed August 21). Competing motions to appoint interim co-lead class counsel were filed August 7 and are awaiting decision (free public docket on CourtListener, read August 22, 2026). There is still NO settlement administrator and NO official claims site for this breach — none exists.
Current Status
Who Is Affected?
DentaQuest's updated regulatory disclosures now put the breach at more than 23 million affected people — revised upward from the 15 million initially confirmed (early independent analyses of the leaked files had already pointed to this larger number). DentaQuest administers Medicaid and CHIP dental benefits across all 50 states — if you or your child had DentaQuest dental or vision coverage, watch your mail. Separate letters are going to parents of affected minors and to families of deceased members. State attorney-general filings so far include roughly 3.97 million Texas residents and 522,000 Massachusetts residents.
Is There a Payout?
Timeline
- 1
May 17–20, 2026 — Network Intrusion
Unauthorized access to DentaQuest's network; the company detects it on May 20. Around May 22 the ShinyHunters extortion group claims the attack on its leak site and sets a ransom deadline of May 27.
- 2
Late May 2026 — Stolen Files Leaked to the Dark Web
After failed ransom negotiations, the stolen files are published (ShinyHunters claims ~234 GB — the attackers' own figure). An independent researcher examining the dump reports a folder of roughly 1.7 million unique Social Security numbers — many belonging to children.
- 3
June 1–9, 2026 — Class-Action Wave Begins
Nine federal class actions hit the District of Massachusetts in nine days — first-filed May v. DentaQuest Group (No. 1:26-cv-12458, June 1), followed by Cantu, Straud, Hilaire, King (No. 1:26-cv-12529), Banuelos, McElroy, Epiter-Smith, and Morrisette — alleging negligence, breach of contract, unjust enrichment, and invasion of privacy.
- 4
July 16–17, 2026 — Public Notice + Letters Mail
DentaQuest posts its public notice on July 16 and begins mailing individual notification letters July 17 on a rolling basis. Each letter contains a unique activation code for 24 months of free Kroll monitoring — enroll by the deadline stated in your letter.
- 5
July 31, 2026 — Cases Consolidated; Leadership Fight Underway
Judge Angel Kelley consolidated the overlapping suits on July 31, 2026 (Fed. R. Civ. P. 42(a)); new cases keep arriving and are folded in — 23 related actions by August 21, 2026. On August 7 competing groups of plaintiffs' firms moved for appointment as interim co-lead class counsel; once the court picks leadership, a consolidated amended complaint follows, and DentaQuest's response is due 45 days after that. No settlement negotiations have been publicly reported.
- 6
Settlement — Not Yet
When a settlement fund, administrator, and claim form actually exist, this page will be updated with the official links and deadlines. Until then: there is nothing to file.
Scam & Misinformation Warnings
A 23-million-person breach with children's SSNs in the wild is a scammer's dream. Watch for these:
Fake 'DentaQuest settlement claim' sites
No claims portal exists. Any page, ad, or social post offering a DentaQuest payout form today is a scam or clickbait. When a real settlement comes, the administrator's URL will appear in court filings — and on this page.
Phishing that quotes your real data
The thieves HAVE real SSNs and member IDs — a call or email quoting your genuine details is not proof it's legitimate. DentaQuest's outreach is by mailed letter. Verify through the official notice on dentaquest.com and call only the assistance number printed in your own letter.
Fee-charging 'enrollment help' or 'lawsuit sign-up'
Kroll enrollment is free with the code in your letter, and you do not need to 'register' or pay anyone to be part of the class action — if a class is certified, affected people are included automatically.
Frequently Asked Questions
Is there a DentaQuest settlement?
No. As of August 22, 2026 there is no settlement, no claims administrator, and no fund. What exists: 23 federal class actions, consolidated on July 31, 2026 into In re: DentaQuest Group, Inc. Data Incident Litigation, No. 1:26-cv-12458 (D. Mass., Judge Angel Kelley). Given the scale — 15M+ people, SSNs plus health data, children affected — a settlement is realistic over a 1–3 year litigation path. Bookmark this page; we update it when a claims process exists.
I got a DentaQuest letter — what should I do right now?
Three things: (1) Enroll in the free 24-month Kroll monitoring using the activation code in your letter — your letter states the enrollment deadline, and it's typically only a few months, so don't sit on it. (2) Consider a free credit freeze at Equifax, Experian, and TransUnion — the strongest protection when your SSN is exposed. (3) Watch bank statements and dental/medical Explanation of Benefits documents for services you never received.
How much money will I get?
Honestly: $0 today — there is no fund. For a realistic reference point if a settlement eventually happens: comparable healthcare mega-breach settlements have paid documented out-of-pocket losses (often capped around $5,000–$10,000) plus small pro-rata cash payments (typically $50–$100). That is speculation until an actual settlement exists.
My child's data was exposed — what now?
Sadly common here: DentaQuest covers Medicaid/CHIP dental, so millions of affected members are children, and a researcher found ~1.7 million SSNs in the leak, many belonging to minors. Parents receive separate letters. Freeze your child's credit at all three bureaus (free, requires a mailed request for minors) and watch for any credit activity in the child's name — child identity theft often goes unnoticed for years.
What data was stolen?
Depending on the individual: full name, address, Social Security number, member ID, Medicaid/Medicare number, and dental or vision health information (providers, diagnoses, treatment, billing). Some records also include date of birth, phone, email, and government-issued ID numbers. Not every data element applies to every person — your letter states what was involved for you.
Do I need to sign up for the lawsuit?
No. If a class is certified or a settlement is reached, everyone who fits the class definition is included automatically — you'd only act later to file a claim or opt out. Be wary of sites urging you to 'register for the DentaQuest lawsuit' today; at this stage nobody can add you to anything.
When will there be a settlement?
Healthcare data-breach class actions of this size typically take 1–3 years from filing (June 2026) to a settlement — if they settle at all. The first milestone is already done: consolidation (July 31, 2026). Still to come: appointment of interim co-lead counsel (contested motions filed August 7), a consolidated amended complaint, mediation, then preliminary approval. We update this page at each milestone.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Medtronic Breach (3.8M affected)
Healthcare breach — same no-settlement-yet stage
HCIactive Breach (3M affected)
Healthcare breach — same no-settlement-yet stage
ZOLL / LifeVest Settlement ($3.5M)
Medical-device data breach — claims open until Sep 2
Data Breach Settlement Calculator
All breach trackers + payout estimator
Latest on This Case
What changed most recently — approvals, payment dates, deadlines, and the questions people keep asking.