← Blog

Keep Smiling Data Breach: Dental PHI, Some SSNs (Aug 2026)

Share on X

29 August-5 September 2026: Keep Smiling Dental Group in Beavercreek, Ohio, says files were accessed or taken from its network. Found 7 September. Census unpublished. See the Keep Smiling Dental breach record.

The practice website notice is the primary source. FBI notified. HIPAA Journal 13 November. Helpline 833-918-1289, engagement B175906, or office 937-426-5340. Two offices: Indian Ripple and Lakeview.

What happened at Keep Smiling Dental?

Network disruption, then a finding that a cybersecurity incident let an outsider access or take files between 29 August and 5 September. First activity identified 7 September. File review finished. Direct letters go to people the practice can address. Extra server controls and phishing training followed.

This is a two-office family practice, not a national DSO. Do not import Park Dental's 1.28 million census into this row. recordsAffected stays 0.

What data was exposed?

Name plus one or more of patient ID, date of birth or age, address, phone, email, dental insurance, billing, dental records including X-rays, treatment plans and clinical notes, medical history, appointments. A limited set also had SSNs.

X-rays plus clinical notes are PHI even when an SSN is absent. Freeze credit if the letter lists an SSN.

The Park Dental post is the large November DSO file. Keep Smiling is a different Ohio practice.

Who is affected?

People whose information sat in the copied files, including some staff if team-member data was in those files. The notice says the practice is still matching addresses. Someone who only joined after 5 September is not automatically in the window.

More on the practice is on the Keep Smiling Dental Group company page.

What should patients do?

  1. Call 833-918-1289, 9 a.m. to 9 p.m. ET weekdays, engagement B175906, if you are unsure.
  2. Place a freeze if an SSN may be involved.
  3. Watch explanation-of-benefits mail.
  4. The practice will never ask for an SSN, bank data or password by email or text.
  5. Office line 937-426-5340 if the helpline is unclear.

A class-action advertisement is not the official notice.

How many people were copied?

Unpublished. Do not multiply two office rosters and call that a census.

If HHS later posts a number, this catalog will move recordsAffected. Until then it stays 0.

Frequently asked questions

How many people were affected?

Unpublished. recordsAffected stays 0.

When did this happen?

Files accessed or taken 29 August to 5 September 2026. Found 7 September.

Were Social Security numbers involved?

For a limited number of people. The practice is notifying those people directly when it has addresses.

Were X-rays copied?

Dental records including X-rays, treatment plans and clinical notes are on the possible field list.

Which offices?

Indian Ripple and Lakeview in Beavercreek, Ohio.

Sourcing note: Practice website notice at roddydental.com, HIPAA Journal 13 November 2026.

Do not download alleged Keep Smiling Dental Group dumps. This catalog does not link them. A later leak-site post is still an unverified brand until Keep Smiling Dental Group names it.

Compare later mail with roddydental.com. Keep Smiling Dental Group will not ask for a card CVV or a one-time code through a new website to finish this investigation.

Do not merge this row with Park Dental. They are separate catalog files even when they share a season or a vendor class.

If you did not receive a letter, you may still be in an unpublished state filing. Ask Keep Smiling Dental Group in writing whether your identifier sits in the reached file.

US residents can place a free credit freeze at Equifax, Experian and TransUnion. Use the local freeze or watch process named in the notice if you live elsewhere.

Keep the paper letter if one arrives. A later amendment can add fields or a higher census. This catalog will move recordsAffected only when a named official source publishes a new figure. Do not treat a class-action advertisement as a census.

If two organisations share a similar name, read the company page before you enrol in monitoring. Wrong-firm sign-up pages are a common follow-on scam after a widely reported notice.

People who already froze credit last year should still read the new letter, because the field mix may differ this time. A freeze stays in place until you lift it.

Call the helpline on the letter, not a number that arrives by text the same week. Helpline hours are in the notice. After hours, use the website URL printed on the letter.