How do I know if I am affected by the 360 Dental PC data breach?

360 Dental PC is mailing notification letters directly to affected individuals. If you have received care or services from 360 Dental PC in the period leading up to January 2026 and you have not received a letter, contact the entity directly. 11,273 individuals were confirmed affected in the HHS OCR filing.

What data was exposed in the 360 Dental PC breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Date of birth, Home address, phone, email, Patient / chart number, Dental clinical records (treatment history, clinical notes, x-rays, diagnostics), Insurance provider and member ID, Appointment data, Emergency contacts, Social Security number (limited subset).

Was 360 Dental PC attacked by a ransomware group?

No threat actor has publicly claimed responsibility for the 360 Dental PC breach. The incident is categorized in the HHS OCR portal as a ransomware.

What is HealthConsent and how does it help with the 360 Dental PC breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by 360 Dental PC addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Philadelphia, PA Disclosed January 15, 2026

360 Dental PC Data Breach 2026: 11,273 Philadelphia Dental Patients Exposed. Ransomware Encryption. No Credit Monitoring Offered. What To Do

Q: Should I file a lawsuit over the 360 Dental PC data breach?

3 plaintiffs' firms have publicly announced investigations or filed complaints related to the 360 Dental PC breach: Strauss Borrelli (publicly investigating), Lynch Carpenter (publicly investigating), Srourian Law (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

360 Dental PC, a Northeast Philadelphia dental practice, disclosed in January 2026 a November 2025 ransomware attack that encrypted internal server files and exposed names, dates of birth, dental clinical records, and (for some) Social Security numbers for 11,273 patients. No complimentary credit monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Nov 16, 2025

Unauthorized actor encrypts files on internal server

Nov 16, 2025

Breach detected

Dec 27, 2025

Individual notification letters mailed

Jan 15, 2026

Filed with HHS OCR

Jan 26, 2026

First plaintiff-firm investigations announced

Nov 16, 2025

Unauthorized actor encrypts files on internal server

Nov 16, 2025

Breach detected

Dec 27, 2025

Individual notification letters mailed

Jan 15, 2026

Filed with HHS OCR

Jan 26, 2026

First plaintiff-firm investigations announced

Data exposed

High-risk identity

Enables financial + identity theft

Date of birth Social Security number (limited subset)

Health records

Don't expire and can't be reissued

Dental clinical records (treatment history, clinical notes, x-rays, diagnostics)

Contact & insurance

Phishing + targeted scams

Full name Home address, phone, email Patient / chart number Insurance provider and member ID Appointment data Emergency contacts

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Strauss Borrelli (publicly investigating) Lynch Carpenter (publicly investigating) Srourian Law (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

360 Dental PC is a single-location general and cosmetic dental practice at 1350 E Lycoming Street, Northeast Philadelphia (19124), led by Dr. Mikhail Sitkovetskiy. The practice offers general, emergency, cosmetic, restorative, and pediatric dentistry.

On November 16, 2025, an unauthorized actor accessed the practice’s internal server and encrypted files (ransomware / file-locking incident). The practice discovered the incident the same day. Individual notification letters were mailed on December 27, 2025, the HHS OCR filing was made on January 15, 2026, and plaintiff-firm investigation announcements began on January 26, 2026 — confirming 11,273 affected individuals.

No specific ransomware group has been named publicly. No leak-site listing has surfaced.

What was stolen

Full name, date of birth, address, phone, email
Patient / chart number
Dental clinical records — treatment history, clinical notes, x-rays, diagnostics
Insurance provider and member ID
Appointment data
Emergency contacts
Social Security number (limited subset)

No payment-card data mentioned.

What 360 Dental is offering

Security uplift: replaced affected workstations, rebuilt server, updated software, added firewalls, AV, MFA, VPN-only remote access, offsite backups
For consumers: no complimentary credit monitoring. Self-help guidance only — fraud alerts with Equifax, Experian, TransUnion and annualcreditreport.com
Practice main line: 267-506-1680
Notice statement: “We have no indication that your information has been misused.”

The absence of credit monitoring for an 11K-affected breach with SSN exposure (even for a subset) is unusual and is likely a focal point of any class action.

What to do

Place free credit freezes at Equifax, Experian, and TransUnion.
File IRS Form 14039 if your letter indicates SSN exposure.
Consider purchasing your own credit monitoring — 360 Dental is not providing one.
Stop the ongoing flow of your dental treatment data. HealthConsent files HIPAA restriction requests so the data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.