Cure Dental 2025 Data Breach

The primary source is Cure Dental's Website Notice to Patients on its own domain. The practice directly explains the discovery date, technical response, possible personal-data fields, its finding that patient PHI was not affected, and identity-protection steps recommended to patients.

The second confirmation is HHS OCR's breach report, which identifies Cure Dental as a healthcare provider, classifies the event as a hacking/IT incident involving a network server, reports 878 individuals, and gives a June 23, 2026 submission date. Claim Depot independently reports the same count, discovery date, and data categories using the official page and HHS record.

After detecting unauthorized cyber access, the practice immediately locked down its network, terminated external connections, disabled accounts with remote-desktop web access, and forced an office-wide password reset. Its cybersecurity platform detected and effectively stopped the movement of malicious activity across the network.

The official text describes what appeared to be a ransomware attack but does not identify an attacker or group. The intruder later contacted the office several times and demanded that staff manually activate malware files left on the system; staff did not comply and the attempts stopped. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope.

The investigation found that the patient-record platform, although restricted, was restored quickly and archive data was not affected. Still, the practice determined that some personal information associated with patients may have been accessed during the event. The sources do not disclose an exact file count, download volume, or access duration.

The incident date is based on the earliest technical activity that can be verified from public sources. The official notice says information may have been accessed but does not confirm that it was published or sold. The HHS submission date roughly one year later is a regulatory-reporting step, not the incident date.

Potentially affected fields include a name, address, date of birth, Social Security number, and driver's-license number. This combination creates substantial exposure to fraudulent account opening, impersonation, credit fraud, and targeted social engineering. The practice also reported that one patient received a call from someone posing as an information-technology professional.

The patient immediately ended the call and informed the practice, and Cure Dental reported no additional suspicious activity. The official page does not say every field was present for all 878 people or provide field-level counts.

Cure Dental expressly said the incident did not affect patient Protected Health Information such as treatment and payment information. It also said the patient-record platform was restored and archive data was not affected.

Association with a dental practice may still matter for privacy, but the available sources do not confirm exposure of health information beyond that relationship.

Potentially affected people should obtain free reports from the three major credit bureaus, review unfamiliar accounts and inquiries, and consider a fraud alert or free credit freeze. Identity information should never be shared with callers claiming to represent Cure Dental; verification should be initiated through a contact channel on the practice's official website.

The practice published the toll-free 888-766-1488 number for incident questions. Evidence of an unfamiliar account, credit inquiry, or impersonation call should be preserved and reported to the relevant organization and, when appropriate, law enforcement. If a suspicious message or account event appears, it should be verified through the organization’s current official contact channel without using links in the message. When an individual notification letter is available, it is the primary source for the person-specific data scope and protection options offered. Dates and data categories should be interpreted only to the extent supported by public sources; undisclosed details should not be treated as confirmed.