Pecan Tree Dental Data Breach 2026 (Sinobi Ransomware): 13,300 Texas Dental Patients Exposed. 250 GB Stolen and Leaked. What To Do

What happened

Pecan Tree Dental, PLLC is a single-location general and cosmetic dental practice at 775 W Westchester Parkway, Grand Prairie, Texas, led by Dr. Mikhail Sitkovetskiy. Services include preventive, cosmetic, restorative, emergency, and pediatric dentistry.

On January 11, 2026, the Sinobi ransomware group attacked Pecan Tree Dental, encrypted files, and exfiltrated approximately 250 GB of data. The practice discovered the incident the same day. Sinobi posted Pecan Tree Dental to its dark-web leak site at 18:55 UTC that same day, naming the practice alongside seven other US victims (FOX Architects, CVMG, Granville Inn, ITG Electronics, Ingomar Church, Vernon Sales, Youngstown Pipe & Steel) and ultimately leaking the data.

Pecan Tree Dental’s website notice predates Sinobi’s public leak and states the practice has “no indication that any patient information has been accessed or misused” — a position that conflicts with Sinobi’s verified leak posting.

Individual notification letters were mailed on December 27, 2025 (note: the notice mail date precedes Sinobi’s January leak listing). The HHS OCR filing was made January 26, 2026, confirming 13,300 affected individuals.

What was stolen

Per the substitute notice and the Texas AG filing:

• Full name, date of birth, address, phone, email
• Patient / chart number
• Dental clinical records — treatment history, clinical notes, x-rays, diagnostics
• Insurance provider and member ID
• Appointment data
• Emergency contacts
• Social Security number (limited subset)

Dental records are unusually intimate from an identity-context standpoint: dental x-rays are sometimes used in forensic identification, and treatment notes can disclose medical conditions (diabetes, immunocompromise) that affect dental care.

What Pecan Tree Dental is offering

• Security uplift: replaced affected workstations, rebuilt server, updated software, added firewalls, AV, MFA, VPN-only remote access, offsite backups
• Self-help guidance for consumers: fraud alerts at Equifax, Experian, TransUnion, free credit reports via annualcreditreport.com
• Practice main line: 267-506-1680
• Plaintiffs’-side coverage indicates credit / identity-monitoring may be offered to impacted individuals; the public notice does not enumerate vendor or duration

The notice’s “no evidence of misuse” framing predates the verified Sinobi leak posting.

What to do

1. Read your specific notification letter carefully for enrollment details on any credit monitoring.
2. Place free credit freezes at all three bureaus.
3. File IRS Form 14039 if your letter indicates SSN exposure.
4. Be aware that your data has been published to a dark-web leak site by Sinobi. Treat the dataset as in-the-wild.
5. Stop the ongoing flow of your dental treatment data. HealthConsent files HIPAA restriction requests and FTC HBNR deletion requests so the data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches