Full Breakdown
ShinyHunters Leaks 234 GB of DentaQuest Data After Ransom Collapse
6/7/2026, 1:39:11 PM
The Leak Unfolds
In late May 2026, ShinyHunters posted a 234-GB archive on its Tor site after ransom talks failed, claiming it had stolen data from DentaQuest. The leak covers roughly 2.6 million accounts, per Have I Been Pwned.
Background & Context
ShinyHunters uses phone-based social engineering to breach cloud services; prior victims include Canvas, Medtronic and the East of England Ambulance Service. DentaQuest, owned by Sun Life’s U.S. Dental subsidiary, provides dental and vision benefits for Medicaid, Medicare Advantage, employers and individuals nationwide.
Key Players
- DentaQuest – Dental and vision benefits administrator (Wellesley, MA).
- ShinyHunters – Extortion gang that released the data.
- Sun Life – Canadian parent company of DentaQuest.
- Troy Hunt – Founder of Have I Been Pwned, monitoring the breach.
Data & Statistics
The leak contains 234 GB of files for about 2.6 million records, including names, addresses, emails, phones, birth dates, genders, government IDs, health-insurance and Medicaid numbers. Roughly 66 % had appeared in earlier breaches; ShinyHunters reports 109 victims in 14 countries over the past year.
Official Response
DentaQuest confirmed the breach on June 2, 2026, calling it “unauthorized access to a limited portion of our network.” It hired external cybersecurity and forensic experts, notified law enforcement, and said systems remain operational with limited service impact. Sun Life has not filed an SEC disclosure.
Criticism
Troy Hunt called ShinyHunters “exceptionally active,” warning that frequent large-scale releases raise phishing and fraud risk. Legal analysts note DentaQuest has not yet reported the breach to the U.S. Department of Health and Human Services or state attorneys general, potentially breaching notification laws.
Conflicts & Gaps
One source says DentaQuest “notified the relevant authorities,” while another indicates no report to HHS or state attorneys general. The intrusion method remains undisclosed, and the attackers’ identities beyond ShinyHunters’ claim are unverified.
Verbatim Quotes
- “failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don’t care.” — ShinyHunters, leak notice
- “We are aware that an unauthorized party has released data related to this incident,” — DentaQuest spokesperson
- “DentaQuest is actively managing a cybersecurity incident involving unauthorized access to a limited portion of our network. Upon discovery of the initial incident, we took immediate action to secure our environment, contain the attack and mitigate the threat,” — DentaQuest spokesperson
- “Courtesy of the ShinyHunters, there’s been just a very large amount of data on a very regular cadence published into the public domain,” — Troy Hunt, Founder, Have I Been Pwned
What's Next
DentaQuest will keep working with external experts to determine the breach’s full scope. Affected individuals are urged to watch for phishing. Legal counsel is assessing potential claims for damages and injunctions to improve cybersecurity.
