Hood River Dental, an Oregon dental practice, confirmed two separate data breaches affecting more than 31,000 patients combined, exposing Social Security numbers, driver’s license numbers, financial and payment card details, and medical information. The first breach began in October 2025 and the second in January 2026. Affected patients should monitor credit reports and consider a credit freeze right away.
| Company | Hood River Dental |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Names, Dates of Birth, Financial Account Information, Payment Card Information, Driver’s License Numbers, Social Security Numbers, Medical Record Numbers, Patient ID/Account Numbers, Medical Diagnoses, Treatment Information, Health Insurance Information |
| People Affected | 31,286 individuals (16,609 and 14,677 across two incidents) |
| Attack Method | Unauthorized Network Access |
| Regulators Notified | Oregon Department of Justice |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Hood River Dental Data Breach?
Hood River Dental, a dental practice with two office locations in Hood River, Oregon, has disclosed two separate data security incidents. Both incidents involved unauthorized access to patient information. The practice reported both events to the HHS Office for Civil Rights as distinct breaches affecting different groups of patients.
According to the practice, unauthorized access to its network occurred in October 2025. This marked the first of the two incidents. The practice says it took steps at the time to contain the activity and secure its systems. However, a second security incident then occurred in January 2026, suggesting the initial containment efforts did not fully prevent a repeat event.
Because of the complexity involved, it took time to confirm the scope of each intrusion. The practice investigated both incidents and, on September 8, 2026, confirmed that patient data had been exposed in each one. This means nearly a year passed between the first intrusion and the public confirmation that patient information was actually compromised.
As part of its response, Hood River Dental also filed formal notification with the Oregon Department of Justice. This filing is a standard step required under state breach notification law when residents’ personal information is compromised. It gives regulators and the public an official record of the incident separate from the federal HHS filing.
Who was affected?
The individuals affected by this breach are patients of Hood River Dental’s two Oregon office locations. Because dental practices often serve entire families, the affected population likely includes both adults and minors who received care at the practice.
The first incident affected 16,609 individuals, and the second affected 14,677 individuals. Combined, more than 31,000 patient records were involved across the two events. It is not clear from available information whether any patients were affected by both incidents, so there may be some overlap between the two totals.
Patients who visited either Hood River Dental location around the relevant time periods should assume they could be part of the affected group. Since the practice has not detailed a specific appointment window tied to each breach, concerned patients should watch for a notification letter rather than guess based on visit dates alone.
What Information Was Potentially Exposed?
Hood River Dental has stated that both incidents involved unauthorized access to similar categories of patient information. This is a notably broad mix of personal, financial, and medical data, which raises the stakes for anyone affected.
- First and last names
- Dates of birth
- Financial account information
- Payment card information
- Driver’s license numbers
- Social Security numbers
- Medical record numbers
- Patient ID or account numbers
- Medical diagnoses
- Treatment information
- Health insurance information
This combination of data creates serious identity theft risk. For example, a criminal who has a name, date of birth, Social Security number, and driver’s license number can often open new credit accounts or file fraudulent tax returns in a victim’s name. Because financial account and payment card details were also exposed, affected patients face a more immediate risk of direct financial fraud on existing accounts.
In addition, the exposure of medical diagnoses, treatment details, and health insurance information introduces the risk of medical identity theft. This happens when someone uses stolen health insurance information to obtain treatment or equipment under another person’s name. As a result, victims can end up with incorrect entries in their own medical records, which can complicate future care and insurance claims.
What is the company doing?
Hood River Dental says it takes data privacy and security seriously. The practice has stated that it is enhancing its security measures to help prevent similar incidents from happening again.
Beyond its public statement, the practice investigated both incidents internally before confirming the scope of exposure on September 8, 2026. It also completed formal notification with the Oregon Department of Justice, fulfilling its state-level reporting obligations. These steps indicate the practice has moved from initial detection through investigation and into formal regulatory disclosure.
The source material does not specify whether Hood River Dental is offering free credit monitoring or identity protection services to affected patients. Anyone who receives a notification letter should review it closely, since it may include details on any protective services being offered that have not yet been made public.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Affected patients should request a copy of their credit report from each of the three major credit bureaus. Reviewing these reports regularly can help catch new accounts or inquiries that were not authorized.
Because Social Security numbers and financial account information were involved in this breach, credit monitoring is especially important here. Federal law allows consumers to access a free credit report from each bureau on a regular basis, so there is no cost barrier to checking this information often.
Consider a Fraud Alert or Credit Freeze
Given that Social Security numbers, driver’s license numbers, and financial details were exposed, affected individuals should strongly consider placing a fraud alert or credit freeze on their credit files. A fraud alert requires lenders to verify your identity before opening new credit in your name, while a freeze blocks new credit inquiries entirely.
Setting up a freeze takes only a few minutes through each credit bureau’s website. Although it adds a small extra step when you apply for new credit yourself, it offers strong protection against someone else opening accounts using your stolen information.
Watch for Signs of Medical Identity Theft
Because medical record numbers, diagnoses, and insurance information were exposed, patients should review their health insurance statements closely. Look for any services, equipment, or visits listed that you do not recognize.
If you spot anything unusual, contact your insurance provider immediately to dispute the charge. This step matters because unresolved medical identity theft can lead to incorrect information in your actual medical file, which could affect future care decisions.
Stay Alert for Phishing Attempts
Criminals often use stolen personal information to craft convincing phishing emails, calls, or text messages. Because this breach included names, dates of birth, and contact-adjacent identifiers, affected patients should be cautious of unexpected messages claiming to be from the dental practice, insurers, or financial institutions.
Never click links or share login credentials in response to an unsolicited message. Instead, verify a request by contacting the organization directly through a phone number or website you already trust.
Seek Professional Guidance if You Experience Fraud
If you discover suspicious activity tied to your identity after this breach, consider speaking with a data breach attorney about your options. Many offer free consultations and can help you understand whether you qualify for compensation.
This is particularly relevant here, since the exposed information includes Social Security numbers and financial account details, both of which carry a high risk of misuse. Acting quickly after noticing fraud can also strengthen your position if you later pursue a claim.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
View the public data breach notification listing from Oregon Department of Justice
Related Data Breaches
- Benchmark Senior Living Data Breach Claim: Personal Information Reportedly Exposed
- Bethany Nursing Home and Health Related Facility (Bethany Village) Data Breach Exposes Social Security Numbers and Health Records
- Minnesota Epilepsy Group, P.A. Data Breach Exposes Social Security Numbers and Health Information