Keep Smiling Dental Group has notified the public of a data breach that may involve patient information. This page explains what the practice has disclosed, what remains unknown, and what steps people can take.
Keep Smiling Dental Group’s Data Breach Investigation
Keep Smiling Dental Group is a privately owned family dental practice based in Beavercreek, Ohio. The practice has posted a notice about a data event involving its computer systems and patient files. The notice says the practice detected a disruption on September 7, 2026, then took steps to confirm its systems were secure and began a thorough investigation into the nature and scope of what happened.
That investigation confirmed the disruption was caused by a cybersecurity incident. According to the practice, certain files were accessed or taken from its network between August 29, 2026 and September 5, 2026. Trade press covering the practice’s November 6, 2026 news release reported the same window. The wording matters: files that were taken, not just viewed, can end up in the hands of criminals who sell or trade personal information.
After the first phase of the investigation, the practice reviewed the affected files to work out exactly what information was involved and whose it was. That review is why individual notices often go out weeks or months after an incident is first detected. The practice has said the types of information exposed vary by person, so two patients can receive notices that list different categories of data.
The practice reported the incident to the FBI and says it is cooperating with the investigation. It also set up a dedicated call center to answer questions, and its notice points people to the three major credit reporting bureaus and the Federal Trade Commission for protective resources. The public notice does not say how many people were affected, and no total has been published. This page does not estimate one.
The notice also does not say how the intruder got into the network, whether a ransomware group or another type of attacker was responsible, or whether a ransom was demanded. It does not say whether the practice is offering free credit monitoring or identity protection. Until the practice or a regulator publishes those details, they should be treated as unknown rather than assumed.
The categories of information the practice lists are sensitive. Dental records can include X-rays, treatment plans and clinical notes, and the practice lists medical history and appointment details as well. Combined with Social Security numbers, dates of birth and insurance details, that is enough for a criminal to attempt medical identity theft, open credit in someone else’s name, or craft a message that sounds like it came from the practice or an insurer.
Healthcare providers of every size are frequent targets because their records are complete and valuable. Small and mid-sized practices often rely on a single network and a handful of vendors, which can make a successful intrusion more damaging. A patient record, unlike a credit card number, cannot be cancelled and reissued, so the exposure can last for years and the risk does not end when the notice letter arrives.
Federal and state laws require healthcare providers to notify patients when protected health information is breached, and many states set their own deadlines for notice. A notice typically describes what happened, lists the types of information involved, and explains what the organization is doing in response. People who were patients of the practice, or who are listed on a family member’s account, should watch their mail and email for a notice and keep it once it arrives.
Anyone who is unsure whether they are affected can call the practice at the number it published, rather than at a number in an unexpected message. Scammers often move quickly after a publicized incident, sending texts or calls that claim to be from the practice, an insurer or a credit bureau. Treat any contact that asks for a Social Security number, a payment, or a login as suspect until you have confirmed it through an official channel.
Attorneys reviewing incidents like this one look at whether the organization took reasonable steps to protect patient data, how quickly it detected and disclosed the problem, and whether affected people may have legal options. This page relies only on what the practice and published reports have said so far, and it may be updated as more information is released.
When Did This Breach Occur?
The practice says certain files were accessed or taken from its network between August 29, 2026 and September 5, 2026. It detected a disruption on September 7, 2026, and trade press reported on its news release of November 6, 2026. The practice has not said when individual notice letters were or will be mailed.
What Information Was Breached?
Keep Smiling Dental Group says the information involved varies by person and may include names, Social Security numbers, patient IDs, dates of birth or age, contact information, dental insurance information, dental account and billing information, dental records, medical history, and appointment or schedule information. Dental records may include X-rays, treatment plans and clinical notes.
What You Can Do
If you received a notice related to Keep Smiling Dental Group or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Ask your insurer for an explanation of benefits and look for services or claims you do not recognize, since dental and medical details were listed among the information involved.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Keep Smiling Dental Group
If you received a notice from Keep Smiling Dental Group, or you believe your personal or dental information was exposed in this incident, you may have legal options. Whether you can seek compensation depends on the facts, and an attorney can explain whether you may be able to join a class action lawsuit over the exposure of your personal information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
