The Tampa Bay Dental Implants & Periodontics 2026 data breach involved a ransomware incident affecting a legacy internal server at the Florida dental practice. The practice said it detected the event on January 19, 2026, immediately secured its environment, and conducted a technical assessment. The affected legacy server held a backup of electronic medical records.
The U.S. Department of Health and Human Services Office for Civil Rights portal lists 6,400 affected people for Tampa Bay Dental Implants & Periodontics. The federal row classifies the event as a Hacking/IT Incident involving Electronic Medical Record and Network Server locations. importedRecordCount is zero because no raw patient data was obtained.
How Was the Tampa Bay Dental Incident Verified?
The primary source is the “Notice of Data Security Incident” on the practice's own tbperio.com domain. The organization directly describes the January 19 detection, ransomware, legacy server and medical-record backup, possible data fields, security improvements, law-enforcement notice, and the 1-866-217-5008 assistance line.
The second source is the HHS/OCR federal row reported March 8, 2026 for 6,400 people. The third is ClaimDepot's incident summary, which is consistent with the organization page and HHS record. The production search covered likely organization names, the tbperio.com domain, slug variations, and the 2026 date range and found no existing matching record.
Nature of the Event and Timeline
The practice detected a ransomware incident affecting an internal legacy server on January 19, 2026. Because the public notice does not separately disclose the actor's first access date, breachDate, dateOccurred, and dateDiscovered use January 19, the first verified time marker. This date does not prove that the ransomware entered the system no earlier.
The organization says it immediately secured the environment and conducted a technical assessment. Encryption of legacy system logs prevented it from forensically ruling out the possibility of unauthorized access. The HHS March 8 report date is a federal notification date; it was not interpreted as the attack start or completion of a data review.
What Information May Have Been Involved?
According to the official security page, the affected legacy server contained a backup of electronic medical records. Possible fields include names, contact information, dates of birth, clinical history, and treatment notes. For certain people, Social security numbers or financial information may also have been present in the backup.
The practice says it notified all patients out of an abundance of caution, and the combination may vary by person. It should not be assumed that every field belonged to all 6,400 people. Passwords, prescriptions, driver's licenses, bank accounts, and fields not expressly identified as separate categories in the official text were not added.
6,400 People Versus Zero Imports
6,400 is the affected-person count published in the HHS/OCR portal for this Florida dental practice; it is not a number of files, emails, or electronic medical-record rows. The federal portal associates the event with both electronic medical record and network server environments. pwnCount and totalRecords equal this official person total.
importedRecordCount 0 means LeakData did not receive raw patient records containing names, Social security numbers, medical details, or financial information. The incident volume displayed to users is 6,400 people, while the number of searchable person-level records is zero. Zero imports do not mean zero affected people.
Identity, Health, and Financial Risks
Names, dates of birth, contact details, and Social security numbers for some people can increase targeted phishing or identity-fraud risk. People whose financial information was involved should monitor account activity. Recipients can review credit reports and consider a fraud alert or credit freeze when appropriate.
Clinical history and treatment notes create privacy and medical identity-theft risks. Patients should review insurance explanations for services they did not receive or claims they do not recognize. Suspicious healthcare activity should be reported to the provider and insurer, while financial activity should be reported through the relevant institution's known contact channel.
Organization Response and Steps for Individuals
Tampa Bay Dental Implants & Periodontics said it implemented enhanced security logging, strengthened server encryption, and updated access controls after the incident. It notified law enforcement and relevant regulators. The investigation found no evidence of exfiltration or misuse, but unauthorized access could not be fully excluded because the logs were encrypted.
Patients who want to learn whether their information may have been involved can call 1-866-217-5008, choose option three, and use the line 24 hours a day. The practice recommends monitoring credit reports and explanation-of-benefits statements. This record compares the official practice page, HHS/OCR row, and an independent summary without adding an unsupported exfiltration claim.
