DentaQuest Data Published After Extortion Demand Refused

DentaQuest, a dental benefits administrator, was compromised in a campaign beginning around May 2026. When extortion did not succeed, roughly 234 GB was published, with about 2.6 million unique email addresses subsequently verified within it.

We filed the opposite outcome in 26-0501, where a payment was made and deletion logs supplied. Setting the two side by side is the closest this desk gets to a controlled comparison, and it is worth being careful about what it shows.

Publication is the outcome the organisation was trying to avoid, and it is permanent in a way the alternative is not: once an archive is public it is mirrored, indexed and traded, and no subsequent decision reverses it.

It also produces something payment does not — a verifiable record. Independent parties were able to establish 2.6 million unique addresses in the published data. In the paid case, nobody outside the negotiation knows what was taken or whether it was destroyed.

It would be convenient to conclude that refusing is right because it produces honesty, or that paying is right because it prevents publication. Neither follows. The organisations faced different data, different regulators and different obligations.

What the pair does establish is narrower and, we think, more useful: the affected people learn substantially more when the organisation refuses. Payment buys the possibility of suppression and guarantees that nobody outside the room ever finds out what was in the archive.

Graded medium. The volume and verified address count are consistently reported; the intrusion route has not been established.