What Happened in the Bridle Trails Family Dentistry Data Breach?
Bridle Trails Family Dentistry, a dental practice based in Kirkland, Washington, has disclosed a data breach affecting thousands of patients. The Bridle Trails Family Dentistry data breach involved unauthorized access to an employee email account. As a result, sensitive personal and health information may have been exposed to an outside party.
According to the company’s notification, an unauthorized actor gained access to a single employee email account. This access occurred over a roughly one-week period, between Nov. 19, 2024, and Nov. 25, 2024. During this window, the intruder could have viewed any personal and health information stored within that account.
Because email accounts often hold years of accumulated messages, determining exactly what was exposed took time. The company launched an investigation to assess the scope of the intrusion. On March 12, 2026, roughly 15 months after the unauthorized access occurred, investigators determined that sensitive information had likely been accessible to the attacker.
This lengthy gap between the intrusion and the discovery of affected data is not unusual in email compromise cases. As a result, reviewing the contents of a single mailbox for personal and health details can be a slow, document-by-document process. The company disclosed the breach to the U.S. Department of Health and Human Services on May 14, 2026.
Who was affected?
The breach affects patients of Bridle Trails Family Dentistry whose information was stored in the compromised employee email account. Approximately 20,976 individuals in the United States were affected, according to the company’s disclosure. This makes it a significant incident for a single dental practice.
Because the exposed account belonged to an employee handling patient matters, those impacted are likely current or former patients of the practice. The notification does not specify whether minors were included among the affected individuals. However, dental practices commonly treat patients of all ages, so this remains a possibility.
Not everyone affected had the same categories of information exposed. Specifically, the types of data compromised varied by individual. Some patients may have had only a few data elements exposed, while others may have had more extensive information involved.
What Information Was Potentially Exposed?
The compromised email account contained a mix of personally identifiable information and protected health information. In addition, the exact combination of exposed data differed from person to person. Below are the categories of information the company identified as potentially involved.
- Full name
- Date of birth
- Social Security number
- Driver’s license number
- Taxpayer ID number
- Reason for visit
- Medical provider name
- Clinical or treatment information
- Health insurance information
- Medical record number
This combination of data creates real risk for affected individuals. For example, a Social Security number paired with a full name and date of birth gives criminals nearly everything needed to open new credit accounts. In addition, driver’s license numbers and taxpayer ID numbers can be used to commit various forms of identity fraud.
The health-related information raises separate concerns. Because insurance details and medical record numbers were involved, affected individuals could face medical identity theft. This occurs when someone uses stolen health information to obtain treatment or submit fraudulent insurance claims in another person’s name. As a result, victims may see unfamiliar charges or incorrect entries in their medical records.
What is the company doing?
After detecting the unauthorized access, Bridle Trails Family Dentistry launched an investigation into the nature and scope of the incident. The review focused on determining whether sensitive data had actually been accessed or acquired by the unauthorized party. Following this review, the company stated it found no evidence that any information had been misused as a direct result of the incident.
Despite this finding, the company chose to notify affected individuals out of an abundance of caution. It began sending notification letters on April 10, 2026. In addition, the company posted a notice on its website explaining the incident and offering guidance on protective steps.
To support affected individuals, Bridle Trails Family Dentistry set up a dedicated, confidential toll-free response line. The number, 833-289-6183, is staffed by professionals familiar with the breach. It is available Monday through Friday from 8:00 a.m. to 8:00 p.m. Eastern Time, excluding holidays. Anyone who believes they were affected but did not receive a letter can call this line for more information.
What Should Affected Individuals Do?
Monitor Your Credit Reports Regularly
Affected individuals should check their credit reports for unfamiliar accounts or inquiries. You can request free copies from each of the three major credit bureaus. Reviewing these reports regularly helps catch fraudulent activity early.
Because Social Security numbers and driver’s license numbers were exposed, this step is especially important. If you notice unfamiliar accounts or hard inquiries, dispute them immediately with the credit bureau. Acting quickly can limit the financial damage from identity theft.
Consider a Fraud Alert or Credit Freeze
Given that Social Security numbers, driver’s license numbers, and taxpayer ID numbers were involved, placing a fraud alert or credit freeze is a wise precaution. A fraud alert requires creditors to verify your identity before opening new accounts in your name. A credit freeze goes further by blocking access to your credit file entirely.
Both options are free and can be requested directly through the credit bureaus. While a credit freeze offers stronger protection, it also requires you to temporarily lift it when applying for new credit. Therefore, choose whichever option best fits your situation.
Watch for Medical Identity Theft
Because health insurance information and medical record numbers were exposed, affected individuals should watch for signs of medical identity theft. This includes unfamiliar charges on insurance statements or medical bills for services you never received. It can also include incorrect entries appearing in your medical history.
If you spot anything unusual, contact your insurance provider and healthcare providers right away. Request copies of your medical records to check for inaccuracies. Correcting these errors promptly helps prevent complications with future medical care or insurance coverage.
Stay Alert for Phishing Attempts
Criminals often use stolen personal information to craft convincing phishing emails or phone calls. As a result, affected individuals should be cautious of unexpected messages referencing personal or medical details. Never click links or share information in response to unsolicited communications.
Instead, verify the sender’s identity through official channels before responding. For example, if you receive a message claiming to be from your dentist or insurance provider, call the organization directly using a known number. This simple step can prevent you from falling victim to a scam built on your stolen data.
Seek Guidance if You Have Concerns
If you received a notification letter, take time to read it carefully. It should outline exactly which types of information were involved in your case. If you have questions, you can call the dedicated response line the company set up for this incident.
In addition, some affected individuals may want to consult a data breach attorney for a free case evaluation. An attorney can help you understand your rights and whether you may be eligible for compensation. This is particularly relevant given the sensitivity of the Social Security numbers and health information involved in this breach.
More Information
HHS Office for Civil Rights Breach Notification Portal
Official Data Breach Notification Letter (PDF)