Kidz R Kool Pediatric Dentistry Data Breach: A Ransomware Claim, No Lawsuit Yet
Active Litigation
On October 15, 2026, the ransomware group LockBit 5.0 listed Kidz R Kool Pediatric Dentistry, a pediatric dental practice in Peoria, Arizona, as a victim. That is the attacker’s claim. As of October 18, 2026, the practice has not published a notice we could find, no number of affected patients has been reported, and no Kidz R Kool Pediatric Dentistry data breach lawsuit has been filed — lawyers are only investigating. There is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Has Actually Been Reported
Everything known so far comes from ransomware tracking sites, not from the practice. The dark-web monitor Ransomware.live lists kidzrkooldental.com as a victim of Lockbit5, discovered October 15, 2026, and describes the victim as a dental practice in Peoria, AZ. The cybersecurity blog HookPhish reported the same claim, and the tracker Breachsense lists it as discovered October 16, 2026, with the leak size “Unknown.”
What was taken, if anything, has not been stated. No source we reviewed names the data types or a patient count. Ransomware groups post victims to pressure them into paying; a listing is a claim, not a confirmed breach. Breachsense also shows one email account from the practice’s domain in two older external breaches and says they are not necessarily connected to this attack.
Case details
No lawsuit has been filed that we could find. As of October 18, 2026, our federal docket database shows no case naming Kidz R Kool, and the only legal activity is a lawyer-recruitment page published October 16, 2026 asking whether a class action can be brought. An investigation is not a case: it has no court, no case number and no judge. If a suit is filed, it would most likely land in an Arizona state court or the U.S. District Court for the District of Arizona; we will add the court and case number once one exists.
Status: Unconfirmed Claim, No Notice, No Case
The next real signal is a notice letter. Under Arizona law (A.R.S. 18-552), once a business determines there has been a breach it has 45 days to notify affected people, and if more than 1,000 people must be notified it must also tell the Arizona attorney general and the three largest credit bureaus. A dental practice is also covered by HIPAA, which requires patient notice no later than 60 calendar days after a breach is discovered and a report to the U.S. Department of Health and Human Services for breaches of 500 or more people. Either notice can be delayed if law enforcement asks.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Could Be Affected
If the claim is real, the people at risk are the practice’s patients — mostly children and young adults — their parents or guardians, whose names, addresses and insurance details sit in a child’s dental file, and current or former employees. That is the same group the lawyers’ investigation is looking for.
The practical test is your mail. If your family was a patient, watch for a letter from Kidz R Kool or a vendor acting for it. It should say what happened and which fields were in your record. Keep the letter and the envelope. No letter so far is not proof you are unaffected — the notice windows above had not run out by October 18, 2026.
Is There Any Money?
Kidz R Kool Breach Timeline
October 15, 2026 — LockBit 5.0 Claims the Attack
Ransomware.live records kidzrkooldental.com as a Lockbit5 victim, discovered the same day. The practice has not confirmed it.
October 16, 2026 — Trackers and Lawyers Pick It Up
Breachsense lists the claim with leak size unknown, and a lawyer-recruitment page opens an investigation. No lawsuit is filed.
45 Days After Confirmation — Arizona Notice Deadline
If the practice determines a breach occurred, Arizona law gives it 45 days to notify affected people, and the attorney general if more than 1,000 are involved.
60 Days After Discovery — HIPAA Notice Deadline
HIPAA requires patient notice no later than 60 calendar days after discovery, plus a report to HHS for breaches of 500 or more people.
As of October 18, 2026 — No Notice, No Case
No breach notice, no patient count, no lawsuit, no settlement and no claim form exist that we could find.
Three Things to Watch For
A ransomware claim against a children’s practice, with no official notice yet, is an easy story for imposters to borrow:
“Your child’s records were leaked — verify now”
Calls, texts or emails claiming to be the dental office and asking for your child’s Social Security number or date of birth to “check” exposure. A real notice tells you what happened; it does not ask you to re-send your data. Call the office back on a number you already have.
“Pay to get your data deleted”
Messages that cite the LockBit leak and offer to remove your family’s files for a fee. No one can buy back stolen data for you, and paying marks you as a target.
“Claim your Kidz R Kool settlement”
There is no settlement and no claims site. A form asking for payment card details or Social Security numbers to “secure your share” is collecting data, not filing anything. A lawyer investigation form is also not a claim.
Kidz R Kool Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Was Kidz R Kool Pediatric Dentistry hacked?
It is claimed, not confirmed. On October 15, 2026, the ransomware group LockBit 5.0 listed kidzrkooldental.com as a victim, per Ransomware.live. As of October 18, 2026, the practice had not published a notice we could find.
Is there a Kidz R Kool Pediatric Dentistry data breach lawsuit?
No, not as of October 18, 2026. Lawyers opened an investigation on October 16, 2026 into whether a class action can be filed, but no case, court or case number exists. We will update this page if one is filed.
What data was exposed, and how many people?
Unknown. No source has named the data types or a count, and Breachsense lists the leak size as unknown. If more than 1,000 people need notice, Arizona law requires a report to the attorney general; breaches of 500 or more must also be reported to HHS.
How much compensation will I get for a data breach?
For this incident, nothing — there is no lawsuit, settlement or fund. In general, breach settlements pay only after a case is filed and resolved, and the amount depends on the data exposed and on losses you can document. See our calculator for what resolved cases have paid.
How can I check if I have been data breached?
For this practice, watch your mail: Arizona law requires notice within 45 days after a breach is determined, and HIPAA within 60 calendar days after discovery. Breaches of 500 or more patients are also reported to HHS. Keep any letter you receive — it is your record of what was exposed.
My child is a patient. Should I freeze their credit?
It is free and a reasonable step. The FTC says parents can request a free credit freeze for a child under 16 at each of Equifax, Experian and TransUnion; the process differs from an adult freeze, and the freeze stays until you remove it. See the FTC guidance.
Is this the same as the Downriver Pediatric Associates breach?
No. Downriver Pediatric Associates is a separate case tied to a vendor hack. See our Downriver page. Kidz R Kool is a ransomware claim against the Arizona practice itself.
What is worth doing right now?
Freeze your own credit and your child’s — free and reversible. An initial fraud alert is also free, lasts one year and needs only one bureau. Read insurance explanation-of-benefits statements for dental care you never received. Keep any notice letter.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Downriver Pediatric Data BreachA different pediatric breach, tied to a vendor hack
- O2 Dental Group Data BreachAnother dental-practice breach and where that case stands
- Data Breach Settlement CalculatorWhat resolved breach cases have paid, by data type
- Open Class Action SettlementsSettlements taking claims right now, with deadlines