Northwest Denture Center Data Breach 2025: 19,419 Patients Exposed in May Network Intrusion · Class Action Filed in Snohomish County

Northwest Denture Center, Inc., a denture and dental practice headquartered in Burlington, Washington with offices including a Bellingham clinic, confirmed that an unauthorized actor accessed its network on May 27, 2025. Suspicious activity was detected the following day, and a file review concluded on June 27, 2025 that personal, identity, and medical information for 19,419 individuals, including 12,209 Washington residents, had been exposed. The incident was reported to the U.S. Department of Health and Human Services Office for Civil Rights and to the Washington State Attorney General on July 25, 2025. A putative class action, Osborne v. Northwest Denture Center, was subsequently filed in Snohomish County Superior Court.

The substitute notice published by Northwest Denture Center also disclosed that certain patient records from the Bellingham office were deleted during the intrusion and could not be recovered, indicating destructive activity in addition to data exfiltration. Northwest Denture Center has not publicly identified the threat actor or confirmed whether ransomware was deployed.

Timeline

• May 27, 2025 — Unauthorized access to Northwest Denture Center’s network occurs.
• May 28, 2025 — Suspicious network activity is detected; the practice begins its investigation and engages outside experts.
• June 27, 2025 — Review of the compromised files is completed; the affected-individual count is established.
• July 25, 2025 — HIPAA breach notification filed with HHS OCR (19,419 affected, “Hacking/IT Incident” at Network Server). Notice also filed with the Washington State Attorney General reporting 12,209 Washington residents.
• July 30, 2025 — Plaintiff-side law firms publicly announce class-action investigations.
• August 18, 2025 — Public reporting and substitute-notice coverage describes the scope and exposed data.
• September 15, 2025 — Putative class action Osborne v. Northwest Denture Center, Case No. 25-2-08604-31, filed in Snohomish County Superior Court.

What was exposed

According to the substitute notice and Washington Attorney General filing, the data elements involved vary by individual but include:

• Name, address, and full date of birth
• Social Security number
• Washington driver’s license number or state ID card number
• Patient ID number
• Medical information (treatment-related records)

The notice indicates that certain Bellingham-office patient records were destroyed during the incident and could not be restored. The unauthorized-access method has not been publicly disclosed, and no ransomware group has claimed responsibility on any tracked leak site.

What the entity is offering

Northwest Denture Center is providing 12 months of complimentary credit monitoring and identity theft protection services through TransUnion to notified individuals. The enrollment instructions and access code are included in the individual notification letter, and affected individuals must enroll within 90 days of receiving the notice.

The notice also includes general guidance on placing fraud alerts and security freezes with the three nationwide credit reporting agencies, and on reviewing account statements and Explanation of Benefits records for suspicious activity.

Class-action and regulatory posture

The first known class action arising from the incident, Osborne v. Northwest Denture Center, Case No. 25-2-08604-31, was filed in the Snohomish County Superior Court in Washington. Multiple plaintiff-side firms, including Strauss Borrelli PLLC, Barnow and Associates, P.C., and Milberg Coleman Bryson Phillips Grossman PLLC, opened public investigations beginning in late July 2025. Allegations focus on inadequate data-security practices and failure to protect sensitive patient information.

The HHS OCR portal entry remains open. No federal settlement, consent order, or civil monetary penalty has been publicly announced.

What to do if you may be affected

• Enroll in the offered credit monitoring if you received a notice with a TransUnion activation code. The 90-day enrollment window is short and the activation code is single-use.
• Freeze your credit with Equifax, Experian, and TransUnion. Because Social Security numbers and Washington state ID data were exposed, a security freeze is materially more protective than monitoring alone. It is free and reversible.
• Request a copy of your dental and medical record if you had treatment at the Bellingham office. The notice confirms some patient records were destroyed; documenting your treatment history with your insurer and any subsequent provider protects continuity of care.
• Watch for medical identity theft. Review every Explanation of Benefits from your dental or medical insurer and flag any services you did not receive.
• Preserve your notice letter if you intend to participate in the Snohomish County class action or any consolidated proceeding. The letter is the simplest proof of class membership.
• Be alert to targeted phishing. Threat actors with name, address, date of birth, and dental-treatment context can craft highly convincing follow-on lures referencing your Northwest Denture Center visits.

Sources

• HHS Office for Civil Rights Breach Portal — federal regulatory record (filing dated July 25, 2025; 19,419 affected; Hacking/IT Incident at Network Server).
• Washington State Attorney General — Data Breach Notifications Directory — state regulatory filing (12,209 Washington residents).
• ClassAction.org — Notice of Privacy Incident (Northwest Dental and Denture, PDF) — substitute notice from Northwest Denture Center.
• ClassAction.org — Northwest Dental Data Breach Affects 19K; Lawsuit Being Investigated — incident summary including Bellingham record destruction.
• ClaimDepot — Northwest Denture Center Data Breach Affects 12,209 in Washington State — timeline, exposed data, credit-monitoring offer.
• HIPAA Times — Northwest Denture Center Breach exposes data of over 12,000 Washington residents — corroborating timeline and data elements.
• Strauss Borrelli PLLC — Northwest Dental Data Breach Investigation — plaintiff-side investigation announcement.
• Barnow and Associates, P.C. — Northwest Denture Center, Inc. Data Breach Investigation — plaintiff-side investigation summary.
• Law.com Radar — Osborne v. Northwest Denture Center — Snohomish County Superior Court case record (No. 25-2-08604-31).