Hood River Dental, a general dentistry practice in Oregon, posted a data breach notice on October 8, 2026 describing two separate cybersecurity incidents. The notice says personal and health information may have been accessed, including Social Security numbers, treatment details and financial account information.
If you were a patient of the practice, or received a letter from it, here is what has been made public so far and what you can do about it.
Hood River Dental’s Data Breach Investigation
Hood River Dental is a general dentistry practice located in Oregon. Like any dental office, it keeps a detailed file on each patient, covering identity details used for scheduling and billing, insurance information, payment records, and clinical notes about diagnoses and treatment. A security incident that reaches those files can expose far more than a name and address, which is why this notice deserves a careful read from anyone who has visited the practice.
According to the notice the practice posted to its website on October 8, 2026, Hood River Dental experienced a cybersecurity incident affecting certain systems within its network environment on or around October 22, 2025. After identifying that incident and evaluating its systems, the practice says it experienced a second cybersecurity incident a few months later, on January 15, 2026. Two events in a single network environment, separated by roughly three months, is a notable detail for patients to be aware of.
The practice states that its investigation concluded on September 8, 2026, when it determined that certain files containing personal and health information may have been accessed by an unauthorized party as a result of the incidents. That means almost eleven months passed between the first incident and the date the practice says it reached that conclusion. The notice says the practice is in the process of notifying the individuals whose information was potentially affected.
The incident was also reported to the Massachusetts Office of Consumer Affairs and Business Regulation on the same day the website notice was posted. Massachusetts requires organizations to report breaches that involve its residents, so that filing suggests at least some of the people notified live in that state. The sources we reviewed do not say how many people in total received notice, and this page does not state a number.
The notice lists the categories of information that may have been exposed, and says they vary by individual. They include names, dates of birth, financial account information, payment card information, driver’s license numbers, Social Security numbers, medical and patient account numbers, medical diagnoses and treatment information, medical record numbers and health insurance information. Not every person is affected in the same way, and your own letter is the best source for which items relate to your file.
That combination is unusually broad. A Social Security number together with a name and date of birth is enough to apply for credit in someone else’s name. A driver’s license number can support identity checks or a forged ID. Payment card and financial account details create a risk of unauthorized charges. Medical record numbers, insurance details and treatment information can be used for medical identity theft, where someone obtains care or files claims under another person’s identity, and that kind of fraud can be slow to notice.
The notice does not say how the unauthorized party gained access, who was responsible, or whether any data was published or sold. Hood River Dental has not, in the material we reviewed, explained what changed in its systems after the second incident. This page does not guess at those points, and nothing here should be read as a finding about the cause of either event.
Dental and other small healthcare practices are frequent targets for cyberattacks because their records combine financial and medical identifiers in one place, and many rely on outside vendors for billing, imaging and scheduling. We are describing the general landscape only. The notice does not tie these incidents to any particular vendor or method.
If you received a notice from Hood River Dental, read it closely and keep it. It is the best source for what applies to you, including whether the practice is offering credit monitoring or identity protection at no cost and how long you have to enroll. If you were a patient but have not received anything, you can contact the practice to ask whether your information was involved.
Because medical information may be involved, it is also worth reading your insurance explanation of benefits statements as they arrive. Unfamiliar claims, bills for services you did not receive, or letters about coverage you did not request can be early signs that someone has used your details.
A data breach class action is one way people affected by a security incident can seek accountability from an organization that did not adequately protect their information. Whether a claim makes sense depends on facts that are still emerging in this matter, which is why speaking with a lawyer about your own situation is a reasonable step if you were notified.
When Did This Breach Occur?
According to the practice’s notice, the first cybersecurity incident occurred on or around October 22, 2025, and a second incident followed on January 15, 2026.
The practice says it determined on September 8, 2026 that certain files may have been accessed. It posted its website notice and reported the matter to the Massachusetts Office of Consumer Affairs and Business Regulation on October 8, 2026.
What Information Was Breached?
The notice says the exposed information varies by individual and may include names, dates of birth, financial account information, payment card information, driver’s license numbers and Social Security numbers.
It may also include medical and patient ID account numbers, medical diagnoses and treatment information, medical record numbers, and health insurance information. Your own notice letter is the best source for what applies to you.
What You Can Do
If you received a notice from Hood River Dental or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Watch your financial accounts, tax records and any insurance or medical statements for activity you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the organization, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov and to your state Attorney General.
File a Data Breach Lawsuit Against Hood River Dental
If your personal or health information may have been exposed in these incidents, you may have legal options. Organizations that hold sensitive patient information are expected to safeguard it, and a class action can help hold an organization accountable when it fails to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
