Absolute Dental Group
Disclosed May 2, 20251 year ago1,223,635 affectedSettled
MSP account used to breach Absolute Dental, exposing 1.2M patients
Nevada dental chain Absolute Dental said attackers used an account of its managed service provider Judge Consulting to access its network between February 19 and March 5, 2025, exposing SSNs, license numbers, health and financial data of 1,223,635 people; it settled for $3.3 million.
What is known
| People affected | 1,223,635 (as reported to HHS) |
|---|---|
| Disclosed | May 2, 2025 |
| Discovered | Feb 26, 2025 |
| Happened | Feb 19, 2025 |
| Attack | Vendor breach |
| Data exposed | Names, Health, Social Security numbers, Government IDs, Insurance, Financial |
| Sector | Healthcare · US |
| Status | Settled |
| Lawsuit or fine | $3.3M class action settlement (2026) |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Absolute Dental Groupoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Absolute Dental Groupatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Absolute Dental Groupjustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report: Absolute Dental Group (Business Associate, NV)ocrportal.hhs.gov · Official notice | Official notice |
| Absolute Dental Settles Class Action Data Breach Lawsuit for $3.3Mhipaajournal.com · News | News |
| Largest Healthcare Data Breaches of 2025hipaajournal.com · News | News |
| May 2025 Healthcare Data Breach Reporthipaajournal.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS OCRtotal | May 2, 2025 | 1,223,635 |
| Researchtotal | Jun 26, 2025 | 1,223,635 |
| California AGresidents of CA | Aug 26, 2025 | |
| Washington AGresidents of WA | Aug 26, 2025 | 1,001 |
| Oregon DOJresidents of OR | Aug 26, 2025 | 1,223,635 |
History of this record
- 2026-09-25 · status: confirmed to settled · seed source
- 2026-09-25 · lawsuit: empty to $3.3M class action settlement (2026) · seed source
- 2026-09-25 · attack: ransomware to third-party · seed source
- 2026-09-25 · data_types: ["names","health"] to ["names","health","ssn","government-id","insurance","financial"] · seed source
- 2026-09-25 · summary: empty to Nevada dental chain Absolute Dental said attackers used an account of its managed service provider Judge Consulting to access its network between February 19 and March 5, 2025, exposing SSNs, license numbers, health and financial data of 1, · seed source
- 2026-09-25 · title: empty to MSP account used to breach Absolute Dental, exposing 1.2M patients · seed source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 1223635 · backfill source
- 2026-09-25 · disclosed: 2025-08-26 to 2025-05-02 · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2025-02-26 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.