One of the larger dental breaches of the year is now in patients' mailboxes. Park Dental Partners, Inc., based in Roseville, Minnesota, says an unauthorized party got into its network between August 26 and August 27, 2026, and that "a limited amount of personal information was removed." Written notices went out on or about November 6, 2026. The company's filing with the Texas Attorney General the same day lists 1,276,335 people affected in total, 2,481 of them in Texas, according to breach trackers that publish the Texas AG data. That number is the headline. For a small practice, the useful part is how the incident unfolded and what the company was able to say afterward.
What Park Dental Partners has said
From the company's public notice and its SEC Form 8-K filed October 13, 2026:
- Detection: the company identified unauthorized access to its network on August 28, 2026, started its incident response, brought in outside cybersecurity and forensic specialists, and notified law enforcement.
- Window: the unauthorized access occurred August 26 through August 27, 2026.
- Data: the investigation and document review concluded October 7, 2026. It found that full names were removed along with one or more of: dates of birth, treatment/diagnosis information, and health insurance policy information.
- Misuse: the company says it is not aware of any identity fraud or improper use of the information.
- Notice: letters to affected individuals began on or about November 6, 2026, with a call center at 888-517-6470 (Monday through Friday, 9am to 9pm Eastern).
- Lawsuits: the 8-K lists four putative class actions in Ramsey County, Minnesota, the first filed September 3, 2026, and a motion to consolidate filed October 7. The company says it intends to defend them, anticipates regulatory responses, and has not identified a material financial impact.
Separately, security trackers report that the Chaos extortion group posted a claim naming parkdental.com on its leak site on October 1, 2026. Park Dental Partners' notice and filings do not name any group or describe the incident as ransomware.
What we are not claiming: We are not saying this was ransomware, that any systems were encrypted, that offices closed or care was disrupted, that a ransom was demanded or paid, or that Social Security numbers or payment cards were involved. None of that appears in the company's notice or 8-K. The 1,276,335 total comes from the Texas AG filing as reported by breach trackers, not from the company's own notice. The Chaos claim is the group's claim, and it is unverified. Park Dental Partners is not a Brotherly client.
Why it matters to a three-chair office
You are not a 1.28 million-patient dental group. But the notice describes problems we find in small practices all the time. The company hasn't said where on its network the data sat, but the categories it lists (names, birth dates, treatment and insurance details) are exactly what we find in loose files in small practices: exported patient lists, insurance spreadsheets, scanned treatment notes and old reports saved to a shared drive. It took the company from late August to October 7 to work out exactly who was affected, and that review is the expensive part. It only works if you have logs that show what was touched. And every notice has to go out by mail to a last known address, so somebody needs a clean patient address export that isn't on the server that just got hit.
What to do this month
- Find the PHI that lives outside your practice management system. Search the server and shared drives for exports, spreadsheets, scanned EOBs, insurance verification lists and old reports. Delete what you don't need and move what you do need into the system that has access controls.
- Lock down remote access. Every way into your network from outside (remote desktop, VPN, the vendor's support tool, the doctor's home login) should require MFA and belong to a named person. Remove accounts for former staff and vendors you no longer use.
- Make sure your logs would answer "what was taken and when." Turn on file-access and sign-in logging on the server and in Microsoft 365, and keep at least 90 days somewhere an attacker on the server can't delete. Without logs, assume everything on the share was taken and notify accordingly.
- Watch for large outbound transfers. Removing data takes time and bandwidth. A firewall or endpoint tool that alerts on unusual uploads after hours is one of the cheapest ways to catch it while it's happening.
- Write your incident contact sheet now. Your IT provider, your cyber insurance carrier's hotline (call them before you hire anyone), a breach attorney, and the FBI's IC3. Print it. Your server may not be available when you need it.
- Keep a notification-ready address export offline. HIPAA notices to patients go by first-class mail. A recent export of patient names and mailing addresses, encrypted and stored off the main network, saves weeks.
- Prepare the front desk for the calls. When notices land, patients call, and scammers call too. Give staff a short script, tell them the practice will never ask for card numbers or passwords by phone, and have them route anything unusual to the office manager.
The takeaway for IT decision-makers
Park Dental Partners says the intrusion lasted about two days. The investigation took about six weeks, and the mailed notices came more than two months after the incident. For a small practice the cost lives in that gap: not knowing what was on the network, not having logs to narrow it down, and not having a plan for telling patients. Get PHI out of loose files, put MFA on every remote door, keep logs where an attacker can't reach them, and have your call list printed before you need it. If you want a second set of eyes on where your patient data actually lives, Brotherly Technology can help.
Sources
- Park Dental Partners, Inc.: Notifies Affected Individuals of Information Security Incident (notice; letters sent on or about Nov 6, 2026)
- Park Dental Partners, Inc. Form 8-K, Item 1.05 (filed Oct 13, 2026)
- BreachRecord: Park Dental Partners, Texas Attorney General filing of Nov 6, 2026 (1,276,335 total; 2,481 Texas residents)
- CyPro: Chaos leak-site claim naming parkdental.com, Oct 1, 2026 (unverified claim)