Aesthetic Dental Designs P.A. Data Breach

HYFLOCK listed Aesthetic Dental Designs, P.A. on its dark web leak portal on October 25, 2026, and the listing was identified through SOCRadar’s Dark Web Monitoring service. The victim is a dental practice based in Lake Worth Beach, Florida, operating commercially as Dental Arts of Atlantis and providing restorative, cosmetic, and family dentistry to patients across South Florida. As a healthcare provider in the United States, the practice holds exactly the type of information extortion groups prize: patient records containing names, insurance data, treatment histories, and billing details. For a small healthcare provider, that data is all the leverage an extortion group needs, which explains why even a dental practice can end up on a ransomware leak site. The listing fits HYFLOCK’s recent targeting pattern closely. In the 60 days before this listing, the group focused on healthcare and professional services organizations in the United States. Dental practices, optometry clinics, and ambulatory health providers recur in its leak-site listings — small-to-mid-size operations that hold patient data and often operate with limited dedicated IT security resources. Aesthetic Dental Designs matches that profile exactly: a U.S.-based healthcare provider whose patient data and smaller security footprint place it squarely within the sectors and geography HYFLOCK has prioritized in its recent activity, making the claim consistent with the group’s established pattern rather than an outlier.

SOCRadar’s stealer-log query for dentalartsofatlantis[.]com returned no records in this sample. The check searched stealer-log telemetry for credentials associated with the domain used by Dental Arts of Atlantis, the practice’s commercial identity. However, the query is paginated and bounded, meaning it covers only a limited sample of available data rather than the full dataset. Credentials may also exist under a staff member’s personal email alias or under a domain variant that was not sampled, and neither would appear in a query scoped to the primary commercial domain. The result therefore provides no positive signal of compromise — but it is not an all-clear, and it does not confirm that the organization is unaffected. Several additional limitations shape how this negative result should be read. Records may exist in stealer-log feeds outside the queried dataset, or data captured from the practice’s environment may not yet have been indexed at the time of the check. Credentials may likewise have been used and rotated before any indexing occurred, leaving no trace in the sample reviewed. The absence of matching entries is not evidence that no compromise took place; it reflects only what was and was not present in the bounded sample queried. Against that backdrop, the HYFLOCK leak-site listing remains an allegation of compromise, and the credential check neither substantiates nor refutes the group’s claim. Given these limitations, continued dark web and stealer-log monitoring is advisable so that any future exposure tied to the practice’s domains, domain variants, or staff personal aliases is detected early. Proactive credential-hygiene checks are also warranted, including password rotation, a review of multi-factor authentication coverage, and checks for credentials appearing under alternate corporate domains or personal email aliases. These steps directly address the sampling gaps identified in the telemetry review and reduce the risk that exposed credentials could be leveraged for unauthorized access.