DentaQuest Data Breach Affects Over 23 Million People

What Happened

DentaQuest, one of the largest dental and vision health benefits administrators in the United States, has been rocked by a massive data breach potentially affecting more than 23 million people. The company, a subsidiary of Sun Life, announced that attackers had infiltrated its systems, accessing the highly sensitive personal and medical information of millions of customers. The incident has sent shockwaves through the cybersecurity world and the healthcare sector.

According to the company's statement, the cyberattack was detected on May 20. Forensic investigations revealed that the attackers had unauthorized access to DentaQuest's network between May 17 and May 20, a period of approximately three days. This short window was sufficient for the attackers to identify and exfiltrate a large volume of data, highlighting the targeted and organized nature of the attack.

Responsibility for the attack has been claimed by the notorious extortion group ShinyHunters. The group announced that it had leaked a massive dataset of approximately 234 GB, which it claimed was stolen from DentaQuest. ShinyHunters is known in the cybercrime world for targeting large corporations and then selling or leaking the acquired data on dark web forums. The group's claim of responsibility reinforces the seriousness of the breach and the likelihood that the data is now in the hands of malicious actors.

What Data Was Stolen

The nature of the data compromised by the cyberattack significantly increases the severity of the incident. This is not just a simple leak of emails and passwords; it includes highly sensitive information that could be used for identity theft and fraud, profoundly impacting the lives of the victims. The types of data exfiltrated include:

• Personal Identification Information: Full names, postal addresses, email addresses, and phone numbers.
• Financial and Government ID Information: Social Security numbers (SSNs), member identification numbers, Medicaid and Medicare numbers, and government-issued IDs.
• Dates of Birth: A critical piece of information often used in identity verification processes.
• Insurance Information: Policy details such as the benefits provider's name.
• Protected Health Information (PHI): Perhaps most alarmingly, this includes patients' extremely private medical records, such as diagnoses, treatment details, and billing information.

The combination of this data is a goldmine for cybercriminals. Social Security numbers can be used to apply for fraudulent credit cards, take out loans, or commit tax refund fraud in the victims' names. The stolen medical information (diagnoses and treatments) provides a perfect foundation for targeted phishing attacks. For example, attackers could send convincing but fake emails to a victim stating, "You have an unpaid bill for your recent dental treatment," in an attempt to steal more information or money. Such sensitive health information could also be used for blackmail.

How the Attack Happened

DentaQuest has not yet publicly shared the technical details of how the attackers breached its network. Official statements have not provided information on the specific attack vector, the vulnerabilities exploited, or the tools used. For now, the only known facts are that the attackers gained access to the network between May 17 and May 20 and managed to exfiltrate data during this time.

Groups like ShinyHunters, which claimed responsibility, typically use a variety of methods, such as phishing attacks, infiltrating systems with stolen credentials, or exploiting unpatched security vulnerabilities in corporate networks. However, there is no official confirmation as to which method was used in the DentaQuest case. The results of the ongoing investigation by the company's cybersecurity experts and potentially law enforcement may shed more light on how the attack occurred in the future.

Who Is Affected

Different numbers are being cited regarding the number of individuals affected by the breach, which illustrates the complexity of the situation. According to DentaQuest's official filings with the Attorney General's Offices in Texas, Massachusetts, and South Carolina, the company is sending written notifications to at least 4.5 million people. However, this figure may only cover the legal requirements in those three states.

Healthcare industry publications like the HIPAA Journal report that the number of potentially affected individuals is more than 23.4 million. It is also alleged that DentaQuest has unofficially confirmed that at least 15 million people were affected. These figures align with the fact that DentaQuest is a massive organization serving 35 million people across 50 states in the US. Those affected are individuals who receive or have received dental or vision health insurance services through DentaQuest.

What You Can Do

If you are a DentaQuest customer or have used their services in the past, it is crucial to take proactive steps to protect yourself against the possibility that your data has been compromised. Here’s what you can do:

• Take Advantage of the Company's Offered Services: DentaQuest is offering 24 months of free credit monitoring, fraud consultation, and identity theft restoration services to those affected by the breach. Follow the instructions in the notification letter you receive to sign up for these services. Credit monitoring will alert you if a new account is opened in your name.
• Freeze Your Credit Reports: One of the most effective measures is to freeze your credit reports with the three major credit bureaus (Equifax, Experian, TransUnion). This action makes it nearly impossible for fraudsters to open new credit or loan accounts in your name.
• Be Alert for Phishing Attacks: Cybercriminals will use the stolen information to call, email, or text you. They may pose as DentaQuest, your insurance company, or your doctor to request additional information or payments. Do not click on any suspicious links, download files, or share personal information. Always verify the legitimacy of the communication by calling the relevant institution yourself using their official phone number.
• Check Your Account Statements and Medical Bills: Carefully review your Explanation of Benefits (EOB) statements and medical bills. If you notice bills for services you did not receive, contact your insurance company and the relevant healthcare provider immediately. This could be a sign of medical identity theft.

What the Company Is Saying

DentaQuest stated that it discovered the incident on May 20 and immediately launched an investigation. In its official incident notice, the company outlined the steps it is taking for affected individuals. These steps include sending written notification letters to all affected persons and providing 24 months of complimentary credit monitoring and identity theft protection services to help them protect their identities.

The company has stated that the investigation is ongoing and that it is working to strengthen its cybersecurity measures. However, a detailed technical explanation of the root cause of the attack or how similar incidents will be prevented in the future has not yet been provided. Customers and regulatory bodies are awaiting more transparency from DentaQuest regarding the incident.

Source

https://www.securityweek.com/dentaquest-data-breach-potentially-impacts-over-23-million-people/