DentaQuest Data Breach: Is There a Settlement? (September 2026 Status)
One of the largest healthcare breaches of 2026: DentaQuest — the largest US Medicaid dental benefits administrator — has confirmed that at least 15 million people had data stolen, including Social Security numbers and children's records, and says it is still identifying everyone involved; an independent researcher's analysis of the leaked files points to more than 23 million. Notification letters started hitting mailboxes July 17, 2026. Here's the honest status: no settlement exists yet — and here's what you should actually do today.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened — and What the Lawsuit Alleges
Between May 17 and May 20, 2026, intruders accessed DentaQuest's network; the company discovered the attack on May 20. The ShinyHunters extortion group claimed responsibility, demanded a ransom, and — after negotiations failed — published stolen files to the dark web (the group claims roughly 234 GB; that figure is the attackers' own, not independently verified). The pending class actions allege negligence, breach of contract, unjust enrichment, and invasion of privacy: DentaQuest allegedly failed to protect exactly the kind of data (SSNs, Medicaid numbers, children's records) it exists to safeguard.
Case Details
On July 31, 2026 the court CONSOLIDATED the federal class actions under Fed. R. Civ. P. 42(a) — the master case is now In re: DentaQuest Group, Inc. Data Incident Litigation, No. 1:26-cv-12458 (D. Mass., Judge Angel Kelley). The order joined 13 cases; later filings are folded in automatically, and 17 cases were on file by August 24, 2026 (the 17th: Whitlow, No. 1:26-cv-13868). Two groups of plaintiffs' firms are competing to lead the case: a majority slate (Milberg, Stueve Siegel Hanson, Lynch Carpenter) backed by 16 of the 17 cases, and a rival slate (Barnow and Associates, Pastor Law Office). The judge set an in-person hearing on the lead-counsel motion for October 6, 2026 at 11:00 a.m. (free public docket on CourtListener, read September 28, 2026). There is still NO settlement administrator and NO official claims site for this breach — none exists.
Current Status
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Affected?
DentaQuest has confirmed at least 15 million affected people and reported 15,000,000 to the federal HHS breach portal (filed July 16, 2026 — still the listed figure on September 28, 2026). The company says it is still identifying everyone involved; an independent researcher who analyzed unique name-and-birth-date combinations in the leaked files told the HIPAA Journal the total could exceed 23.4 million. Some news reports present that higher number as the toll — it is an estimate, not a DentaQuest figure. DentaQuest administers Medicaid and CHIP dental benefits across all 50 states — if you or your child had DentaQuest dental or vision coverage, watch your mail. Separate letters are going to parents of affected minors and to families of deceased members. State attorney-general filings so far include roughly 3.97 million Texas residents and 522,000 Massachusetts residents.
Is There a Payout?
Timeline
- 1
May 17–20, 2026 — Network Intrusion
Unauthorized access to DentaQuest's network; the company detects it on May 20. Around May 22 the ShinyHunters extortion group claims the attack on its leak site and sets a ransom deadline of May 27.
- 2
Late May 2026 — Stolen Files Leaked to the Dark Web
After failed ransom negotiations, the stolen files are published (ShinyHunters claims ~234 GB — the attackers' own figure). An independent researcher examining the dump reports a folder of roughly 1.7 million unique Social Security numbers — many belonging to children.
- 3
June 1–9, 2026 — Class-Action Wave Begins
Nine federal class actions hit the District of Massachusetts in nine days — first-filed May v. DentaQuest Group (No. 1:26-cv-12458, June 1), followed by Cantu, Straud, Hilaire, King (No. 1:26-cv-12529), Banuelos, McElroy, Epiter-Smith, and Morrisette — alleging negligence, breach of contract, unjust enrichment, and invasion of privacy.
- 4
July 16–17, 2026 — Public Notice + Letters Mail
DentaQuest posts its public notice on July 16 and begins mailing individual notification letters July 17 on a rolling basis. Each letter contains a unique activation code for 24 months of free Kroll monitoring — enroll by the deadline stated in your letter.
- 5
July 31, 2026 — Cases Consolidated; Leadership Fight Underway
Judge Angel Kelley consolidated 13 overlapping suits on July 31, 2026 (Fed. R. Civ. P. 42(a)); later cases are folded in automatically — 17 by August 24, 2026. On August 7 two groups of plaintiffs' firms moved for appointment as interim co-lead class counsel; once the court picks leadership, plaintiffs have 45 days to file a consolidated complaint, and DentaQuest's response is due 45 days after that. No settlement negotiations have been publicly reported.
- 6
October 6, 2026 — Hearing on Who Leads the Case
Judge Kelley set an in-person hearing (11:00 a.m.) on the majority slate's motion to be appointed interim co-lead class counsel; a rival slate has also applied. The appointment starts the clock: 45 days for the consolidated complaint, then 45 days for DentaQuest's response. A procedural step — not a settlement.
- 7
Settlement — Not Yet
When a settlement fund, administrator, and claim form actually exist, this page will be updated with the official links and deadlines. Until then: there is nothing to file.
Scam & Misinformation Warnings
A breach of at least 15 million people, with children's SSNs in the wild, is a scammer's dream. Watch for these:
Fake 'DentaQuest settlement claim' sites
No claims portal exists. Any page, ad, or social post offering a DentaQuest payout form today is a scam or clickbait. When a real settlement comes, the administrator's URL will appear in court filings — and on this page.
Phishing that quotes your real data
The thieves HAVE real SSNs and member IDs — a call or email quoting your genuine details is not proof it's legitimate. DentaQuest's outreach is by mailed letter. Verify through the official notice on dentaquest.com and call only the assistance number printed in your own letter.
Fee-charging 'enrollment help' or 'lawsuit sign-up'
Kroll enrollment is free with the code in your letter, and you do not need to 'register' or pay anyone to be part of the class action — if a class is certified, affected people are included automatically.
Frequently Asked Questions
Is there a DentaQuest settlement?
No. As of September 28, 2026 there is no settlement, no claims administrator, and no fund. What exists: 17 federal class actions as of August 24, 2026 (13 consolidated on July 31, the later ones folded in automatically) in In re: DentaQuest Group, Inc. Data Incident Litigation, No. 1:26-cv-12458 (D. Mass., Judge Angel Kelley), with a hearing on lead counsel set for October 6, 2026. Given the scale — 15M+ people, SSNs plus health data, children affected — a settlement is realistic over a 1–3 year litigation path. Bookmark this page; we update it when a claims process exists.
I got a DentaQuest letter — what should I do right now?
Three things: (1) Enroll in the free 24-month Kroll monitoring using the activation code in your letter — your letter states the enrollment deadline, and it's typically only a few months, so don't sit on it. (2) Consider a free credit freeze at Equifax, Experian, and TransUnion — the strongest protection when your SSN is exposed. (3) Watch bank statements and dental/medical Explanation of Benefits documents for services you never received.
How much money will I get?
Honestly: $0 today — there is no fund. For a realistic reference point if a settlement eventually happens: comparable healthcare mega-breach settlements have paid documented out-of-pocket losses (often capped around $5,000–$10,000) plus small pro-rata cash payments (typically $50–$100). That is speculation until an actual settlement exists.
My child's data was exposed — what now?
Sadly common here: DentaQuest covers Medicaid/CHIP dental, so millions of affected members are children, and a researcher found ~1.7 million SSNs in the leak, many belonging to minors. Parents receive separate letters. Freeze your child's credit at all three bureaus (free, requires a mailed request for minors) and watch for any credit activity in the child's name — child identity theft often goes unnoticed for years.
What data was stolen?
Depending on the individual: full name, address, Social Security number, member ID, Medicaid/Medicare number, and dental or vision health information (providers, diagnoses, treatment, billing). Some records also include date of birth, phone, email, and government-issued ID numbers. Not every data element applies to every person — your letter states what was involved for you.
Do I need to sign up for the lawsuit?
No. If a class is certified or a settlement is reached, everyone who fits the class definition is included automatically — you'd only act later to file a claim or opt out. Be wary of sites urging you to 'register for the DentaQuest lawsuit' today; at this stage nobody can add you to anything.
When will there be a settlement?
Healthcare data-breach class actions of this size typically take 1–3 years from filing (June 2026) to a settlement — if they settle at all. The first milestone is already done: consolidation (July 31, 2026). Next: the hearing on interim co-lead counsel (October 6, 2026; competing applications filed August 7), a consolidated amended complaint within 45 days of the appointment, DentaQuest's response 45 days later, then mediation and preliminary approval. We update this page at each milestone.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Medtronic Breach (3.8M affected)
Healthcare breach — same no-settlement-yet stage
HCIactive Breach (3M affected)
Healthcare breach — same no-settlement-yet stage
ZOLL / LifeVest Settlement ($3.5M)
Medical-device data breach — claims closed; final approval pending
Data Breach Settlement Calculator
All breach trackers + payout estimator
Latest on This Case
What changed most recently — approvals, payment dates, deadlines, and the questions people keep asking.