# DentaQuest breached by ShinyHunters ransomware gang

Published: 2026-05-30 · Severity: high · Sectors: healthcare
Canonical: https://vorant.io/reports/e21d2336-8fbe-5294-82d2-594a3f6b3cbb/dentaquest-breached-by-shinyhunters-ransomware-gang

> ShinyHunters claims breach of dental benefits provider DentaQuest; 749 user accounts and employee credentials exposed.

DentaQuest, LLC, a dental benefits and services provider, has been claimed as a victim by ShinyHunters ransomware operator on ransomware.live. The breach reportedly compromised 749 user accounts and exposed at least one set of third-party employee credentials. The threat actor's post indicates reconnaissance of the victim's external attack surface identified 57 assets, though the underlying stolen data has not been independently verified. DentaQuest provides dental insurance and related services to employers and individuals; a breach of this scale could expose customer personal information, claims data, and employee credentials to misuse in follow-on attacks. The breach has been indexed by Ransomware.live as part of public reporting by the threat actor; defenders at DentaQuest and downstream customers should treat this as a confirmed intrusion requiring credential rotation, breach notification, and forensic investigation.

## Mentioned in this report

- Threat actors: ShinyHunters
- Malware: ShinyHunters

1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/RGVudGFRdWVzdCwgTExDLkBzaGlueWh1bnRlcnM=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e21d2336-8fbe-5294-82d2-594a3f6b3cbb/dentaquest-breached-by-shinyhunters-ransomware-gang.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup