Smile Brands smilebrands.com Smile Brands data breach: what happened and what to do
Smile Brands, a dental support company, reported a ransomware attack in April 2021 that affected 2,592,494 people. Names, dates of birth, addresses, Social Security numbers, diagnoses and lab results were involved.
View all 13,177 breaches- Breach date
- 23 Apr 2021
- Affected
- 2,592,494
- Data exposed
- Names, Dates of birth, Physical addresses, Social security numbers, Diagnoses, Lab results
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Smile Brands provides business support to dental offices. It reported to the U.S. Department of Health and Human Services that it experienced a ransomware incident on April 23, 2021. The count grew as the investigation went on: an early HHS entry listed far fewer people, and a later filing with the Maine Attorney General in April 2022 put the total at 2,592,494, according to SC Media, which noted the figure includes employees as well as patients.
Sources checked: ocrportal.hhs.gov, scmagazine.com, hipaajournal.com
Last verified against the official page:
What was exposed
HHS lists names, dates of birth, addresses, Social Security numbers, diagnoses and lab results. Other reports also mention financial information and government ID numbers, but those aren't in HHS's description, so check your own notice. The Social Security number and date of birth are what criminals use to open credit in your name. Health details make scam calls and letters more believable.
The company's response
Smile Brands notified HHS, the people affected and the media, and posted substitute notice. It offered free credit monitoring and added technical and administrative safeguards.
What this means for you
A dental office you visited may have used Smile Brands without you knowing. If you got a letter, act on it. If you didn't, you're probably not among those notified.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze is free and stops lenders from seeing your credit report, which blocks most new accounts opened in your name. You place it separately at Equifax, Experian and TransUnion, per the FTC. Do it even if you don't plan to apply for credit soon.
- 2
Enroll in the free credit monitoring
If your letter offers it, the FTC recommends taking it. Use the enrollment details in the letter itself.
- 3
Check your credit reports
Look for accounts you don't recognize at annualcreditreport.com.
- 4
Watch for dental and insurance scams
Expect calls or texts about billing or treatment. Don't share details with someone who phones you. Call the number on your insurance card.
- 5
Report misuse
Report identity theft at IdentityTheft.gov to get a recovery plan.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up, so you know when to repeat these steps.
Official filings
- U.S. Department of Health and Human Services , filed 24 Jun 2021 : 2,592,494 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
How many people were affected by the Smile Brands breach?
A filing with the Maine Attorney General lists 2,592,494 people, and SC Media reports the count includes employees.
What was exposed in the Smile Brands breach?
HHS lists names, dates of birth, addresses, Social Security numbers, diagnoses and lab results.
Should I freeze my credit?
If you were notified, yes. Social Security numbers were involved, and a freeze is free.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- scmagazine.com/analysis/breach-update-shows-2-6m-individuals-affected-by-smile-brands-data-theft
- hipaajournal.com/up-to-2592494-individuals-affected-by-smile-brands-ransomware-attack/
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
- annualcreditreport.com
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
Something wrong or out of date? Tell us and we'll re-check it.
