Persona Dental, a family dental practice in Sartell, Minnesota, reported a hacking incident involving a network server to federal regulators in September 2026. The practice told HHS that 3,386 people were affected, according to the public breach portal.
Persona Dental’s Data Breach Investigation
Persona Dental is a general and cosmetic dental practice serving families in Sartell, Minnesota, and the surrounding central Minnesota area. In September 2026 the practice appeared on the U.S. Department of Health and Human Services Office for Civil Rights breach portal, the public listing of healthcare data breaches that affect 500 or more people. The entry is classified as a hacking or IT incident, and the location of the breached information is listed as a network server.
According to that federal listing, the breach was submitted to HHS on September 10, 2026, and the number of individuals affected is 3,386. The listing also indicates that no business associate was involved, meaning the practice reported the incident as one that occurred within its own systems rather than at an outside vendor that handles patient data on its behalf. Persona Dental is categorized as a healthcare provider.
The HHS portal is a summary and does not describe how the intrusion happened, what date it began, or which categories of patient information were taken. At the time of writing, the practice has not published a detailed public explanation that this page can rely on, and the specific data elements involved have not been publicly confirmed. Anyone who receives a notice from the practice should read it closely, because the letter is the best source for what was exposed in each individual case.
A hacking or IT incident entry on the federal portal generally means that an outside party gained unauthorized access to a computer system, rather than a lost laptop or a misdirected piece of mail. A network server in a dental office commonly holds patient scheduling records, billing and insurance information, treatment notes, and digital copies of forms that patients complete when they enroll. Whether those categories were involved here has not been disclosed, and this page does not claim that they were.
Dental practices are a frequent target for this kind of incident. Small and mid-sized healthcare offices hold information that is valuable to identity thieves, including full names, dates of birth, Social Security numbers, insurance details, and payment information, but they often have limited in-house security staff. Federal health privacy rules require covered entities to notify affected individuals and HHS after a breach of unprotected health information, and the portal listing is one product of that requirement.
Under the HIPAA Breach Notification Rule, a covered entity must generally notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach. Breaches affecting 500 or more people must also be reported to HHS and, in many cases, to the media. Because the HHS submission date is September 10, 2026, patients may begin receiving written notices from Persona Dental if they have not already. Minnesota residents may also see the incident referenced by state officials or in local coverage as more details emerge.
Because the number of affected individuals is a known figure but the data types are not, patients should treat the situation cautiously. Even when a notice lists only limited information, medical and dental records can be combined with other leaked data to build a convincing profile for phishing or fraud. Patients of the practice who are unsure whether they were affected can contact the office directly using the phone number on its website and ask whether their records were included in the incident.
This page will reflect only what has been publicly reported. If the practice or a regulator later discloses the date of the intrusion, the cause, or the specific categories of information involved, those facts will matter to anyone evaluating their options after receiving a notice. In the meantime, the safest course for patients is to watch their mail for a notification letter, review their explanation of benefits statements, and keep records of any suspicious activity they notice.
When Did This Breach Occur?
The exact date of the intrusion has not been publicly disclosed. The only confirmed date in the public record is the breach submission to HHS on September 10, 2026. The practice has not yet published when it first detected unauthorized activity or when the network server was accessed. This section will be clearer once the practice’s notification letter or a state filing provides those dates.
What Information Was Breached?
The specific categories of information involved in the Persona Dental incident have not been publicly confirmed. The HHS listing identifies a hacking or IT incident involving a network server and 3,386 affected individuals, but it does not itemize the data. Dental practice servers can hold names, contact details, dates of birth, insurance information, and treatment records. Review any notice you receive for the precise list that applies to you.
What You Can Do
If you are a Persona Dental patient or received a notice, consider these steps:
- Read the notification letter carefully and enroll in any credit monitoring or identity protection it offers.
- Place a fraud alert or credit freeze with Equifax, Experian, and TransUnion.
- Review dental and medical insurance statements for services you did not receive.
- Request a free credit report at annualcreditreport.com and check it for unfamiliar accounts.
- Be wary of unexpected calls, texts, or emails that mention your dental care or billing.
- Report suspected identity theft to the Federal Trade Commission and the Minnesota Attorney General.
File a Data Breach Lawsuit Against Persona Dental
If you received a notice that your information was exposed in the Persona Dental data breach, you may be entitled to compensation. Healthcare providers are expected to take reasonable steps to protect patient information, and when a breach occurs, affected patients can face a lasting risk of identity theft, medical fraud, and targeted phishing.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
