When DentaQuest's breach notification hit inboxes in July 2026, affecting at least 15 million individuals, security teams across healthcare started asking the raw, practical questions that arise after a major incident. These questions come from real conversations with CISOs managing breach response programs, compliance officers interpreting notification requirements, and IR teams figuring out what "immediately" means when dealing with 234 GB of exfiltrated data. The DentaQuest incident, involving unauthorized access between May 17 and May 20, 2026, and subsequent data publication by ShinyHunters, highlights the pressure points every large-scale breach does.
How Fast Do We Need to Move on Forensics?
You've got hours, not days, to engage your forensic team. DentaQuest learned about unauthorized access on May 20 and brought in Kroll immediately. That's the right sequence.
Here's what "immediate" looks like: Have a forensic investigation firm under contract before fully understanding the scope. Your internal team secures the environment and preserves evidence. The forensic team starts data mining to determine what was accessed, when, and by whom. This runs in parallel with containment, not after it.
The HIPAA Breach Notification Rule requires notification "without unreasonable delay and in no case later than 60 calendar days" after discovery. If you wait 45 days to start forensics because you're trying to handle it internally, you'll blow past every reasonable timeline when you realize the scope is bigger than you thought. DentaQuest's breach potentially affects over 23.4 million individuals based on unique identifier analysis, far beyond initial estimates.
Don't try to scope the incident before engaging forensics. Get the experts in, then scope it properly.
Do We Need to Offer Credit Monitoring if SSNs Aren't Confirmed Compromised?
Yes, and here's why DentaQuest's approach matters: They offered 24 months of credit monitoring and identity theft protection even while the data review was ongoing. Initial analysis by Have I Been Pwned suggested Social Security numbers weren't in the leaked dataset. Then a researcher found a folder with more than 1.7 million SSNs, apparently relating to children in Texas.
If you wait for perfect information about what was compromised, you'll be sending your breach notification letter months late. The HITECH Act requires you to offer mitigation services when protected health information is breached. Credit monitoring is standard for incidents involving SSNs or potential identity theft risk.
Your decision tree is simple: If the compromised data includes names plus any combination of SSN, Medicaid number, Medicare number, financial account information, or government-issued ID, offer monitoring. The cost of providing it to people who don't strictly need it is far lower than the regulatory and reputational cost of not offering it to people who do.
Should We Pay the Ransom to Keep Data Off Leak Sites?
DentaQuest didn't pay despite ShinyHunters making "multiple offers" and claiming to exercise "considerable patience." The data got leaked anyway. That's the pattern.
Your organization's policy on ransom payments should be decided now, not during an active incident. Most healthcare organizations adopt a no-payment stance for several reasons: There's no guarantee the attacker deletes their copy. Payment funds future attacks. It may violate sanctions if the group is on OFAC's list. Increasingly, it creates regulatory exposure under frameworks that expect you to maintain security controls, not negotiate with criminals.
The FBI and CISA consistently recommend against paying ransoms. If your board wants to preserve the option, document the decision framework in your incident response plan: under what circumstances, with what approvals, and with what legal review. Then hope you never use it.
How Do We Handle Notification When We're Still Reviewing Data?
You start notifying on a rolling basis as you confirm affected individuals. DentaQuest began sending letters on July 17, 2026, while explicitly stating "the data analysis process is ongoing" in their notification to the California Attorney General.
This is compliant and practical. You don't wait until you've analyzed every file in a 234 GB dataset. You identify cohorts of confirmed affected individuals and notify them in waves. Your notification letter should specify what you know was compromised for that individual, acknowledge that review is continuing, and provide clear next steps.
The 60-day clock starts from discovery, not from when you finish your review. If you discovered unauthorized access on May 20, your notification must begin no later than July 19. DentaQuest hit that deadline with two days to spare by starting notifications on July 17.
What Do We Tell People When the Data Is Already Public?
You tell them the truth: stolen data has been leaked online, and they should take advantage of the monitoring services you're offering. DentaQuest's notification was direct about this.
Your notification letter should be specific about what information was involved. DentaQuest's letter listed: names, addresses, Social Security numbers, member identification numbers, Medicaid and Medicare numbers, and dental or vision health information including provider name, diagnosis, treatment, and billing information. That level of specificity helps affected individuals understand their risk.
Don't soften the message to protect your brand. If data is on a leak site, say so. If it includes SSNs, say so. The affected individuals need to know what they're protecting against. Vague language about "certain information" being "potentially accessed" doesn't meet the HIPAA requirement to describe the breach in plain language.
How Long Does Data Review Take for Something This Big?
Months, and you need to set that expectation internally. Have I Been Pwned identified 2.6 million unique email addresses in the initial leak. An independent researcher analyzing the data found it goes back to at least 2009. Hundreds of thousands of files were exfiltrated.
DentaQuest engaged Kroll for the data mining exercise. That's standard for breaches of this scale. Your internal team doesn't have the tools or capacity to review this volume while also managing containment, evidence preservation, and notification preparation.
The ongoing review is why DentaQuest's initial notification confirmed "at least 15 million individuals" were affected, with the potential to exceed 23.4 million. You notify based on confirmed exposure, then issue supplemental notifications if additional affected individuals are identified.
Where Do We Go From Here?
Your incident response plan should answer every question above before you need it. Document your forensic vendor relationships, your ransom payment policy, your notification procedures for rolling disclosure, and your criteria for offering credit monitoring.
Review your Computer Security Incident Response Team procedures against the NIST Cybersecurity Framework (CSF) 2.0 Respond function. Map your notification obligations under HIPAA, state breach notification laws, and any other applicable frameworks. Test your plan with tabletop exercises that include the messy middle, when you're 30 days past discovery and still don't have complete scope.
The questions don't change much from breach to breach. Your answers shouldn't either.
