# DentaQuest Data Breach: 2.6 Million Accounts Exposed via MOVEit

> DentaQuest confirms a massive data breach impacting 2.6 million users following the exploitation of a critical MOVEit Transfer vulnerability.

- Published: 2026-06-04T20:47:14.000Z
- Severity: high
- Category: Data Breach
- Tags: DentaQuest, MOVEit, CVE-2023-34362, CL0P, Healthcare
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/dentaquest-data-breach-exposed-info-of-26-million-accounts/
- Canonical: https://runtimerebel.com/blog/dentaquest-data-breach-2-6-million-accounts-exposed-via-moveit

## Key points

- Sensitive health and personal data of 2.6 million individuals was compromised due to a third-party software vulnerability.
- The breach stems from the exploitation of Progress MOVEit Transfer versions prior to the 2023 security patches.
- Organizations must patch all managed file transfer services immediately and audit logs for unauthorized file exfiltration.

## Incident Overview

DentaQuest, a prominent dental benefits administrator, has reported a significant data security incident affecting approximately 2.6 million individuals. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/dentaquest-data-breach-exposed-info-of-26-million-accounts/), the breach resulted from the unauthorized exploitation of a managed file transfer platform used by the organization. This incident is categorized under a broader campaign of attacks targeting infrastructure vulnerabilities, emphasizing the risks associated with [Supply Chain Attack](/glossary#supply-chain-attack) vectors in the healthcare sector.

The compromised data varies by individual but generally includes names, addresses, dates of birth, Social Security Numbers (SSNs), and dental or medical insurance information. For organizations managing sensitive health records, this disclosure highlights the persistent threat posed by [Ransomware](/glossary#ransomware) groups that prioritize data exfiltration over encryption to exert pressure on victims.

## Technical Analysis: MOVEit Transfer Exploitation

The root cause of the DentaQuest breach is the exploitation of [CVE-2023-34362](/cve/cve-2023-34362), a critical SQL injection vulnerability in the MOVEit Transfer web application. This [CVE](/glossary#cve) allows an unauthenticated attacker to gain access to the MOVEit Transfer database. Once access is established, attackers can infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements.

During the initial [Zero-Day](/glossary#zero-day) period, the CL0P threat actor group deployed a specialized [TTP](/glossary#ttp) involving the 'LEMURLOOT' web shell. This malware was designed specifically for MOVEit environments to exfiltrate data and steal [Azure](/glossary#cloud-security) storage blob information. The high [CVSS](/glossary#cvss) score of 9.8 reflects the ease of exploitation and the massive impact of successful data theft.

### How to Detect CVE-2023-34362 Exploit Attempts

Security teams must verify their historical logs to ensure they were not compromised during the peak of the MOVEit campaign. To successfully implement a strategy for **how to detect CVE-2023-34362 exploit attempts**, analysts should prioritize the inspection of IIS logs for unusual POST requests to `guestaccess.aspx` or the presence of unexpected files in the `\wwwroot` directory. 

Furthermore, defenders should look for [IoC](/glossary#ioc) patterns such as sessions originating from known malicious IP addresses associated with CL0P. Monitoring for large data outbound transfers from file transfer servers via [SIEM](/glossary#siem) alerts is essential for identifying exfiltration events that may have bypassed initial [EDR](/glossary#edr) detections.

## Mitigation and Long-Term Defense

For entities still running legacy versions of file transfer software, immediate action is required. Applying the **MOVEit Transfer data breach mitigation** steps provided by Progress Software is the only way to close the SQL injection vector. This includes disabling HTTP and HTTPS traffic to the MOVEit environment until patches are verified. 

Beyond immediate patching, organizations should adopt a [Zero Trust](/glossary#zero-trust) architecture for data handling. This involves limiting the amount of time sensitive data resides on internet-facing file transfer servers. A [SOC](/glossary#soc) should enforce strict data retention policies, ensuring that once a file is successfully transferred, it is moved to a secure, non-exposed internal tier. 

Defenders must also evaluate their third-party risk management (TPRM) programs. The DentaQuest incident serves as a reminder that even if an organization's primary network is secure, the vulnerabilities in its vendors' software can lead to a catastrophic data loss. Regular audits of vendor [TTP](/glossary#ttp) profiles and their security posture are no longer optional for high-value targets.

**Related:** [Microsoft Teams Phishing Deploys A0Backdoor via Quick Assist](/blog/microsoft-teams-phishing-deploys-a0backdoor-via-quick-assist), [Progress MOVEit and LoadMaster Patched Against Critical RCE and Bypass](/blog/progress-moveit-and-loadmaster-patched-against-critical-rce-and-bypass)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/dentaquest-data-breach-2-6-million-accounts-exposed-via-moveit