A California dental network company showed up on a ransomware leak-site tracker this weekend. Ransomware.live indexed First Dental Health (firstdentalhealth.com) as a claimed victim of The Gentlemen ransomware group at 2026-10-17 16:52 UTC (about 12:52 p.m. ET Saturday), with an estimated attack date of Oct. 16. Other trackers picked up the same listing Friday afternoon. No data size, ransom demand, screenshot, or file inventory has been disclosed.
First Dental Health's own site describes a company founded in 1995 that is "one of California's largest dental network management companies," running PPO and EPO dental networks, discount dental products, and provider services such as credentialing, re-credentialing, and directory updates. The site lists a San Diego mailing address and says the company is a member of the Principal Financial Group. The public site was up (HTTP 200) when we checked Sunday morning.
What's claimed, and what's confirmed
Claimed: The Gentlemen added First Dental Health to its leak site. A listing is an actor assertion that the organization is a victim. It is not proof of what, if anything, was taken. The group's own blurb describes a Sacramento dental consulting business, which does not match how First Dental Health describes itself, so we are not repeating the actor's names or figures. Tracker pages also attach third-party credential-exposure counts for the domain; those are routine lookups, not evidence of how or whether this intrusion happened.
Not confirmed: As of Sunday morning we found no statement from First Dental Health, no news report, and no regulator or state notice. There is no confirmed encryption, no confirmed theft of patient, member, or dentist data, no reported network or claims disruption, and no word on any payment. Nothing we found suggests the claim involves Principal's own systems. Treat this as a claim until the company says otherwise.
Why it matters to dental offices and the networks they work with
Most dental practices never think of their PPO network manager as part of their IT footprint, but it is. Credentialing packets, W-9s, license and malpractice documents, fee schedules, and remittance or EFT details all move between the office and the network by email, portal, and fax. A headline about any network, clearinghouse, or billing partner is a question for every office on the other end of those connections.
The fastest harm after a leak-site listing is often social engineering, not encryption. Expect criminals to use the news: a "re-credentialing deadline" email with a malicious attachment, a "new fee schedule" link that asks for your login, or a request to update the bank account where reimbursements land. For dental and medical practices across Georgia, Tennessee, Alabama, and the Southeast, the defense is the same: verify any change to payment details or credentials with a phone number you already have, not the one in the message.
Ask the practical question: if your email and practice-management system went dark for a week, could the front desk still check in patients, verify benefits by phone, and reach your networks and clearinghouse from a known number?
Clear takeaway
Treat The Gentlemen's claim against First Dental Health as a continuity and vendor-verification drill for dental offices, DSOs, and the networks they contract with. Protect MFA on email and payer portals, keep restorable backups, and call back on any credentialing or payment-change request, no matter what a leak site alleges.
Actions to take this week
- Require MFA on email, practice-management and imaging systems, insurance and network portals, clearinghouse accounts, and remote-access tools. Retire shared front-desk logins.
- Check leaked-credential exposure for your domain and force resets on anything that shows up, starting with the owner dentist, office manager, billing staff, and anyone with portal admin rights.
- Confirm backups you can restore of the practice-management database, imaging, and documents, with one copy that cannot be changed or deleted. Test a restore this month.
- Make a call-back list for every network, payer, clearinghouse, and lab, using numbers from your contracts, and use it before changing any EFT, remittance, or credentialing detail.
- Brief the front desk and billing team: slow down on urgent "re-credentialing" or "fee schedule" emails and report them instead of clicking.
- Write a one-page incident card: who leads, who calls your insurer, IT provider, and key vendors, and how the office keeps seeing patients if email is down.
Brotherly Technology helps dental and medical practices and other SMBs across Rome, Northwest Georgia, Chattanooga, Tennessee, and the Southeast turn ransomware headlines into a short readiness review covering MFA, backups, vendor access, and payment-change controls. If you want a second set of eyes before the next claim lands, give us a call.
Sources:
- Ransomware.live: First Dental Health / The Gentlemen. Discovered 2026-10-17 16:52 UTC; est. attack date 2026-10-16; no data size; claim-level only.
- First Dental Health (firstdentalhealth.com). Context: California dental network management company founded in 1995; San Diego mailing address; member of the Principal Financial Group. No incident acknowledgment cited here.