The N0n extortion group has added dental benefits insurer Delta Dental of Missouri to its leak site and published data it says came from the company's systems. It says the data includes member and subscriber names, Social Security numbers, dates of birth, home addresses and dental treatment details. The listing appeared on November 5, 2026, and is marked "NOT PAID — EXPOSED", which means the group says no ransom was paid and the data has been released. Delta Dental of Missouri has not confirmed that any data was stolen. A spokesperson told Becker's Dental Review that the company is aware of the posting, has started an investigation and has hired independent forensic specialists. No regulator filing or breach notification has been published, so it is still unknown how many people are affected.
What Happened
Several leak-site trackers recorded the claim on November 5, 2026, including Ransomware.live, HookPhish, SOCRadar and QPulse. Each gives the attack date as the same day. HookPhish's record puts both the breach and discovery timestamps at about 04:52 UTC, only seconds apart. MedRisk notes that a same-day timeline like this fits the date a listing went up better than the result of a finished forensic review. In other words, the date reflects when N0n posted, not when anyone actually got into the network.
Delta Dental of Missouri's statement to Becker's reads: "Delta Dental of Missouri is aware of a posting on a website associated with a purported threat actor that references our organization. We promptly initiated an investigation and engaged independent forensic specialists to help determine the facts." The company added that "our systems and services remain operational, and there has been no disruption to our business operations," and that its investigation is ongoing.
That statement neither confirms nor denies that data was taken. The lack of disruption suggests this is a theft-and-extortion case and not one where systems were encrypted, though that has not been confirmed. Several outlets describe N0n as a ransomware group. MedRisk and SOCRadar both say plainly that a leak-site listing is a criminal group's allegation and not a verified breach. MedRisk adds that it could not confirm the intrusion on its own. Lawyers working with ClassAction.org have opened an investigation into a possible class action and are asking members and current and former employees to come forward.
What Was Taken
N0n's listing, as reproduced by HookPhish, QPulse and MedRisk, describes three sets of data:
- Customer relationship database: 48,528 distinct email addresses and 17,913 telephone number lines. The listing says these were "recovered by direct read." All trackers report the same figures, and MedRisk rounds them to roughly 48,500 and 17,900.
- Member and subscriber service records: full names, Social Security numbers, dates of birth, home addresses and dental treatment details.
- Employer group client records: contacts, addresses and phone numbers for employer clients, plus details of the insurance brokers who serve them.
These counts come only from the attackers. They count email addresses and phone lines, not people, and the listing gives no count of members whose Social Security numbers or treatment records were exposed. The company has not said how many individuals may be affected. If a breach is confirmed, notification filings to the U.S. Department of Health and Human Services and to state attorneys general would be the first official figures.
Why It Matters
If the listing is accurate, the data mixes identity information (Social Security numbers, dates of birth, addresses) with health information (treatment details). That is the combination most useful for identity theft and medical or benefits fraud. MedRisk points out that dental insurers hold something hospitals generally don't: treatment history at the plan level, linked to member identity. A stolen member identifier can be used to bill for procedures that were never performed. MedRisk also warns that if a carrier's systems are compromised, dental practices may find eligibility and claims lookups slower while the insurer recovers. Delta Dental of Missouri says it has seen no disruption so far.
The employer group and broker records add a second risk. Contact details for HR staff at employer clients, and for the brokers who serve them, are ideal material for convincing phishing and invoice fraud aimed at businesses, not just at individual members.
SOCRadar describes N0n as a high-volume operation. It counts 174 victims claimed on the group's leak site in the 60 days before this listing, with healthcare, transportation and technology hit hardest, and U.S. organizations the largest share, followed by South Korea and Brazil. MedRisk calls N0n one of the newer ransomware brands and says it tends to post large numbers of claims in short bursts. That pace calls for some caution about any single claim until the victim confirms it.
The Attack Technique
It is not known how N0n got in. Neither the company nor any official advisory has described the initial access method, and the group has not published technical details. The phrase "recovered by direct read" in the listing could mean the group queried a database directly, but nobody has explained what it means.
SOCRadar says its stealer-log data returned no records for the company's domain in the dataset it searched. It stresses that this does not clear the organization: stolen credentials may exist in sources it did not check, may have already been used and changed, or may be filed under subsidiary domains or personal email addresses. Stolen credentials and phishing are the most common ways ransomware and extortion groups get in, but nothing so far shows either was used here.
What Organizations Should Do
- Members and employer clients should watch for follow-up fraud. Treat unexpected emails, texts or calls that mention Delta Dental of Missouri, claims or benefits as suspect. Consider a credit freeze, and check explanation-of-benefits statements for procedures you never had.
- Dental practices and brokers should verify payment and banking changes through a separate channel. The leaked broker and employer contact data makes it easy to impersonate an insurer or broker. Confirm any request to change payment details by calling a number you already have on file.
- Health insurers should review who can query their CRM and member databases directly. Limit service accounts, require phishing-resistant multi-factor authentication for database and admin access, and alert on large or unusual exports.
- Watch stealer-log and leak-site feeds for your own domains and subsidiaries. As SOCRadar notes, one clean result in a single dataset proves little. Reset credentials found in any feed and investigate how they were exposed.
- Encrypt sensitive fields and keep them separate. Social Security numbers and treatment data should not be readable from the same system that holds marketing and contact records.
- Have a leak-site response plan ready before you need it. Delta Dental of Missouri's fast public acknowledgment and use of outside forensic specialists is a reasonable template. Prepare the statement, the investigation steps and the regulator notification timelines in advance.
Sources: N0n Ransomware Group Exposes Delta Dental of Missouri Customer and... | Delta Dental of Missouri Data Breach? Attorneys Investigate Reports | Delta Dental of Missouri Data Breach - SOCRadar | A dental benefits insurer is named by a newer ransomware brand – Me... | Delta Dental of Missouri Data Breach: N0n Ransomware Claim (Nov 2026) | Ransomware group claims responsibility for Delta Dental of Missouri...