Delta Dental of Missouri Data Breach

Delta Dental of Missouri, a dental insurer serving individuals, families, and employer groups across Missouri and neighboring states, has been listed as a victim on the dark web leak portal of the N0n ransomware group, with the listing dated November 5, 2026. SOCRadar identified the entry through its Dark Web Monitoring service. As a United States healthcare-sector organization, the insurer holds sensitive member and patient records. Dental insurers specifically handle social security numbers, claims histories, treatment records, and employer group data — the kind of structured dataset that commands premium prices on underground marketplaces and creates downstream liability across multiple regulatory frameworks, a combination that can make such organizations attractive targets for ransomware and extortion activity. The claim fits N0n’s established targeting pattern. In the 60 days before this listing, the group claimed 174 victims on its leak portal, with healthcare, transportation, and technology organizations bearing the brunt of its activity. US targets dominate its victim count, followed by South Korea and Brazil. Delta Dental of Missouri therefore matches N0n’s preferred victim profile closely: an American healthcare-sector organization holding sensitive member and patient records. Because the listing originates from a ransomware leak portal, it should be treated as an alleged claim rather than a confirmed breach pending independent verification.

SOCRadar’s stealer-log telemetry returned no records for delta-dental[.]com in the queried dataset. This result does not clear the organization. The queried dataset represents only a limited slice of available underground data: credentials may exist in feeds outside this slice, may already have been used and rotated, or may be indexed under subsidiary domains or personal email aliases not covered by the query. The absence of stealer-log records for the primary corporate domain is therefore an absence of evidence rather than proof that no credentials associated with the organization have been harvested or circulated. For N0n, the working hypothesis is infostealer-sourced access: logs purchased from underground marketplaces, credentials validated against VPN endpoints or Microsoft 365, and ransomware then deployed. This chain remains a hypothesis rather than a confirmed intrusion path — the available telemetry does not establish that this exact method was used against Delta Dental of Missouri. It does, however, illustrate how infostealer-harvested credentials can feed ransomware operations, because validated corporate account access to VPN endpoints or Microsoft 365 could give attackers the foothold needed to move toward data theft and encryption. Regardless of this query’s result, credential hygiene and continued monitoring of delta-dental[.]com assets remain the appropriate next steps. Defenders should keep dark web and stealer-log monitoring in place, check credentials across the primary domain as well as any subsidiary domains or personal aliases, and review VPN and Microsoft 365 authentication activity for signs of unauthorized use. These measures help detect credential-based access paths early, before they can be leveraged for ransomware deployment.