Soniva Dental Care Hit by Ransomware Attack, Exposing Patient Data
In late May 2026, Soniva Dental Care a U.S.-based dental practice with 14 locations discovered a ransomware attack targeting its remote desktop web services infrastructure. The breach was detected after IT support noticed irregularities in remote access sessions, confirming the intrusion within minutes.
On June 1, 2026, the ransomware group The Gentlemen claimed responsibility for the attack via a dark web forum, threatening to publish stolen data within nine to ten days. By July 28, 2026, the group released the full dataset, which included sensitive patient information such as Social Security numbers, names, addresses, dates of birth, driver’s license numbers, government-issued IDs, and protected health information (PHI).
Soniva Dental Care confirmed that personally identifiable information (PII) and PHI may have been accessed during the incident. In response, the company is offering complimentary identity protection monitoring services to affected patients and has reported the breach to the Texas Attorney General and the U.S. Department of Health and Human Services. Practice owner Sumeet Malhotra, DMD, issued a statement apologizing for the incident and emphasizing the company’s commitment to patient privacy.
Source: https://www.claimdepot.com/data-breach/soniva-dental-care-2026
Soniva Dental Care cybersecurity rating report: https://www.rankiteo.com/company/soniva-dental-care
"id": "SON1785284830",
"linkid": "soniva-dental-care",
"type": "Ransomware",
"date": "6/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Patients (number not specified)',
'industry': 'Healthcare',
'location': 'United States',
'name': 'Soniva Dental Care',
'size': '14 locations',
'type': 'Dental Practice'}],
'attack_vector': 'Remote Desktop Protocol (RDP)',
'customer_advisories': 'Complimentary identity protection monitoring services '
'offered to affected patients',
'data_breach': {'data_encryption': True,
'data_exfiltration': True,
'personally_identifiable_information': True,
'sensitivity_of_data': 'High (PII and PHI)',
'type_of_data_compromised': ['Social Security numbers',
'Names',
'Addresses',
'Dates of birth',
'Driver’s license numbers',
'Government-issued IDs',
'Protected health information '
'(PHI)']},
'date_detected': '2026-05-01',
'date_publicly_disclosed': '2026-06-01',
'description': 'In late May 2026, Soniva Dental Care, a U.S.-based dental '
'practice with 14 locations, discovered a ransomware attack '
'targeting its remote desktop web services infrastructure. The '
'breach was detected after IT support noticed irregularities '
'in remote access sessions, confirming the intrusion within '
'minutes. The ransomware group *The Gentlemen* claimed '
'responsibility and later released sensitive patient data, '
'including Social Security numbers, names, addresses, dates of '
'birth, driver’s license numbers, government-issued IDs, and '
'protected health information (PHI).',
'impact': {'brand_reputation_impact': 'Likely negative impact due to data '
'exposure',
'data_compromised': 'Personally identifiable information (PII) and '
'protected health information (PHI)',
'identity_theft_risk': 'High (exposure of SSNs, driver’s licenses, '
'etc.)',
'legal_liabilities': 'Potential regulatory fines and legal actions',
'systems_affected': 'Remote desktop web services infrastructure'},
'initial_access_broker': {'entry_point': 'Remote desktop web services'},
'investigation_status': 'Ongoing',
'motivation': 'Financial gain, data extortion',
'ransomware': {'data_encryption': True, 'data_exfiltration': True},
'references': [{'source': 'Dark web forum (claim by *The Gentlemen*)'}],
'regulatory_compliance': {'regulations_violated': ['HIPAA'],
'regulatory_notifications': ['Texas Attorney '
'General',
'U.S. Department of '
'Health and Human '
'Services']},
'response': {'communication_strategy': 'Public statement issued by practice '
'owner, breach notifications to Texas '
'Attorney General and HHS'},
'threat_actor': 'The Gentlemen',
'title': 'Soniva Dental Care Hit by Ransomware Attack, Exposing Patient Data',
'type': 'Ransomware'}