DentaQuest breached by ShinyHunters ransomware gang
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
ShinyHunters claims breach of dental benefits provider DentaQuest; 749 user accounts and employee credentials exposed.
DentaQuest, LLC, a dental benefits and services provider, has been claimed as a victim by ShinyHunters ransomware operator on ransomware.live. The breach reportedly compromised 749 user accounts and exposed at least one set of third-party employee credentials. The threat actor's post indicates reconnaissance of the victim's external attack surface identified 57 assets, though the underlying stolen data has not been independently verified. DentaQuest provides dental insurance and related services to employers and individuals; a breach of this scale could expose customer personal information, claims data, and employee credentials to misuse in follow-on attacks. The breach has been indexed by Ransomware.live as part of public reporting by the threat actor; defenders at DentaQuest and downstream customers should treat this as a confirmed intrusion requiring credential rotation, breach notification, and forensic investigation.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — rules that match its indicators, converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, plus YARA and Suricata. Three days of it free, no card.
Source reporting: https://www.ransomware.live/id/RGVudGFRdWVzdCwgTExDLkBzaGlueWh1bnRlcnM=
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs