In late 2025, Absolute Dental Group, LLC agreed to pay $3.3 million to settle a class-action lawsuit related to a massive data breach that exposed sensitive personal and health information of more than 1.2 million individuals.

The Breach That Sparked the Settlement

Absolute Dental, headquartered in Nevada and operating more than 50 dental facilities statewide, discovered unauthorized access in its systems between Feb. 19 and March 5, 2025. Forensic investigators determined that the breach was triggered through the accidental execution of a malicious version of a legitimate software tool — introduced via an account associated with a third-party managed services provider. (Becker's Dental Review)

This wasn't a typical "hack into the server" scenario — it was a supply-chain or delegated access compromise, which is one of the most common pathways attackers exploit when targeting healthcare providers.

What Was Exposed?

The breach potentially exposed a wide range of extremely sensitive data, including: (ClassAction.org)

• Names and contact information
• Dates of birth and Social Security numbers
• Driver's license or other government ID numbers
• Health insurance details and explanations of benefits
• Medical and dental treatment histories
• Patient identification numbers
• In some cases, financial account or payment card information

The Settlement Terms

Under the proposed settlement filed in U.S. District Court in Nevada, Absolute Dental will pay $3.3 million to resolve the lawsuit. Class members (i.e., individuals whose data was exposed) could be eligible for up to $5,000 in reimbursements for documented breach-related losses or receive pro-rata payments from the remaining settlement fund. (Becker's Dental Review)

This settlement is still subject to court approval but marks a significant milestone in dental breach litigation — and a sign that regulators and plaintiffs are no longer letting "non-enterprise" healthcare data incidents slide.

Why This Matters for Every Dental Practice

Even if your practice wasn't involved in this specific case, Absolute Dental's experience contains valuable lessons:

1. Breaches Aren't Just "IT Problems"

This incident started with a third-party tool and access credentials. Whether it's a software vendor, managed-services provider, or cloud host — every external relationship is a potential attack vector.

At Darkhorse Tech, we help practices audit and map all third-party access to your systems so nothing slips through the cracks.

2. Patient Trust Has Real Value

More than one million current and former patients had their most personal information exposed. In healthcare, breaches erode trust faster than they erode firewalls — and in dentistry, trust is the foundation of patient relationships.

3. Settlement Costs Don't End With Monetary Payments

Class members may recover some financial losses, but the reputational and operational costs on the provider side can be far more damaging. Lawsuits drive internal reviews, regulatory inquiries, state AG involvement, and potentially long-term compliance monitoring.

4. Cybersecurity Isn't Optional

Dental practices are now being treated like hospitals and health systems by attackers — and by the legal system.

What Dental Practices Should Do Next

Here are proactive steps every dental practice can take to reduce risk and avoid the same fate:

✔ Inventory and Secure All Third-Party Access

If a vendor, MSP, or cloud partner can access your systems or data, ensure they have:

• A signed Business Associate Agreement (BAA)
• Regular security reviews
• Tight access controls and MFA
• Incident response coordination partners

At Darkhorse Tech, we conduct vendor risk assessments and help negotiate BAAs that deliver real protection — not just paper.

✔ Harden Internal Credentials

Credential misuse was a likely factor in this breach. Employ:

• Strong password policies
• Centralized identity management
• Multi-factor authentication (MFA) everywhere

✔ Continuous Monitoring & Detection

Build systems that don't wait for an attack to be reported — instead, detect anomalies early.

✔ Regular Staff Training

Social engineering and phishing attempts are still among the top breach triggers. Training matters more than ever.