Hood River Dental and Artistic Smiles Breach Notices Came Months Later: A Checklist for Dental Practices

Two dental practices have posted breach notices this month, and both arrived months after the break-in. Hood River Dental in Oregon says it had two separate cybersecurity incidents, in October 2025 and January 2026, and is only now notifying patients. Artistic Smiles in Longmont, Colorado, says someone had access to its network for a week in June. Neither practice has described ransomware or an outage. What their notices do show is how long these cases take to untangle, and what a practice can do now to make that shorter.

What the practices have said

Hood River Dental (Oregon):

When: Its notice, updated Oct. 8, 2026, says that "on or about October 22, 2025, we experienced a cybersecurity incident that affected certain systems," and that "on or about January 15, 2026, we experienced another cybersecurity incident."
What the investigation found: The investigation into both incidents "concluded on September 8, 2026," and found that certain files with personal or protected health information "may have been accessed by an unauthorized party."
What was involved: Names plus, depending on the person, dates of birth, financial account and payment card information, driver's license and Social Security numbers, medical record and patient ID numbers, diagnosis and treatment information, and health insurance information.
How many: Oregon's Department of Justice breach database lists 16,609 people affected, with notices sent Oct. 8. ClassAction.org reports it was also reported to Massachusetts regulators.
What it did: The practice says it secured its systems, alerted law enforcement and brought in outside forensic experts. Patients with questions can call 1-888-940-8885.

Artistic Smiles (Lift Dental PLLC, Longmont, Colo.):

When: The practice says it "recently discovered unauthorized access to our network" that "occurred between June 14, 2026 and June 21, 2026."
What was involved: Names, addresses, dates of birth and dental and medical treatment information.
How many: The breach was reported to the U.S. Department of Health and Human Services on Sept. 18, 2026, as affecting 3,735 people and as a hacking incident involving a desktop computer and network server, according to the HHS breach portal listing as summarized by SecureResearch and ClaimDepot. Becker's Dental Review reported it on Oct. 20.
What it did: The practice says it secured its systems, hired cybersecurity experts, reported the matter to law enforcement and is adding safeguards. Patients can call (844) 958-8979.

Not known: Neither notice says how the attacker got in, whether the two Hood River Dental incidents were connected, or whether any patient data has been misused. Neither practice reports ransomware, encrypted systems, a ransom demand or a closed office, and we're not assuming any of that.

Why it matters to dental and medical practices

The gap between the break-in and the letter is the part every practice owner should notice. Once someone has been inside a network, the practice has to work out which files they could reach and whose information is in them. In a dental office that can mean years of scanned intake forms, insurance cards and billing records spread across shared folders and workstations. The fewer places that information lives, and the better the logs are, the faster that review goes.

Hood River Dental's second incident, less than three months after the first, is the other lesson. After any security scare, "we cleaned it up" isn't the same as "we know they're gone." Passwords, remote access tools and old accounts all need a fresh look, or the next problem can come through the same door.

Clear takeaway

Plan for the investigation before you need one: know who you'd call, keep the logs that would answer "what did they see," keep patient ID numbers and card details out of shared folders, and after any incident, confirm the attacker is truly out before getting back to normal.

Actions to take this week

Write down who you'd call. Your IT provider, your cyber insurance carrier's claim line, a breach attorney and your practice-management software vendor. Many cyber policies ask you to call the carrier before you hire outside help.
Turn on and keep logs. Ask your IT provider whether sign-ins, remote access and file access on your server and workstations are logged, and for how long. Ninety days is a sensible minimum. Logs are what let an investigator say "these files, not those."
Shrink what's sitting around. Find old scans of driver's licenses, insurance cards and Social Security numbers in shared folders, desktops and email, and move them into your practice-management system or delete what you don't need.
After any incident, check the doors again. Reset every staff and admin password, remove remote access tools nobody uses, delete accounts for former staff and vendors, and make sure multifactor authentication is on for email, remote access and the practice-management system.
Know the notice clock. HIPAA's breach notification rule requires notice to patients without unreasonable delay and no later than 60 days after a breach is discovered, and states add their own rules. Your breach attorney should confirm the deadlines for your case.
Prepare the front desk. Patients who get a letter will call. A short script, the call-center number and a list of what staff can and can't say keeps the phones from turning into a second problem.
Test your backups. Confirm your server and imaging backups are recent, stored away from the office network and actually restore.

How Brotherly Technology can help

Brotherly Technology works with dental and medical practices to set up logging, clean up stray patient files, lock down remote access and email with MFA, and test backups. If you've had a scare and aren't sure the attacker is gone, call us and we'll help you check.