O2 Dental Group Data Breach

interlock listed O2 Dental Group, a US dental services organization operating under the O2 Smiles brand, on October 5, 2026. The group claims unauthorized access to patient systems and sensitive data, including patient health records, dental imaging, and insurance billing information, all of which are subject to HIPAA regulations. Any ransomware event involving such data carries mandatory breach notification obligations, highlighting the significant regulatory and reputational risks for O2 Dental Group. interlock has claimed 12 victims in the past 60 days, with a pronounced focus on the US healthcare, education, and manufacturing sectors. Recent targets include The Center for Kidney Care, Blaise C. Bender PC, and Tekko Enterprises. The group’s consistent targeting of medical providers suggests a strategy of exploiting the critical nature of healthcare services as an extortion lever, leveraging the pressure to maintain care continuity for negotiation purposes. This pattern indicates O2 Dental Group’s targeting aligns with the ransomware group’s established modus operandi.

SOCRadar’s CTI analysis identified a single workstation compromise artifact associated with the domain o2smiles[.]com. This record was dated December 2025, approximately ten months prior to interlock’s October 2026 listing of O2 Dental Group. While this represents only one artifact, its timing is significant. A compromised endpoint at a dental practice in December 2025 would likely have had access to critical systems, including practice management software, patient portals, and electronic protected health information (ePHI). Such a breach, even affecting a single endpoint within a HIPAA-covered entity, could necessitate mandatory breach notifications. The ten-month interval between the discovery of the stealer artifact and the ransomware group’s listing aligns with a potential “low-and-slow” persistence strategy. This scenario suggests initial access may have occurred in December 2025, followed by a period of internal reconnaissance and lateral movement throughout 2026, culminating in the ransomware deployment in October 2026. This timeline is consistent with advanced persistent threat tactics. O2 Dental Group should thoroughly investigate whether the compromised endpoint in December 2025 had access to ePHI. If ePHI was accessed or exfiltrated, a formal HIPAA breach determination is likely required, necessitating notification to the HHS Office for Civil Rights. Comprehensive review of access logs dating back to December 2025 is critical. Engaging a specialized cybersecurity incident response team with expertise in healthcare environments is strongly recommended to lead this investigation.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.