Smile Brands suffered a data breach incident after it was targeted in a ransomware attack in June 2021. The incident compromised certain protected health information (PHI) of 2,592,494 individuals to an unauthorized third-party. The compromised information included the patients’ names, addresses, telephone numbers, Social Security numbers, dates of birth, health insurance information and/or diagnosis information.

On April 24, 2021, Smile Brands Inc. experienced a ransomware attack that resulted in a significant data breach, as reported by the California Office of the Attorney General on September 3, 2021. The incident compromised protected health information (PHI), exposing sensitive personal details of an unspecified number of individuals. The leaked data included names, addresses, Social Security numbers, and health insurance information, all of which are highly sensitive and regulated under privacy laws.The breach posed severe risks to affected individuals, including potential identity theft, financial fraud, and unauthorized access to medical records. Given the nature of the exposed data—particularly Social Security numbers and health insurance details—the attack had far-reaching consequences for both customers and the organization. The involvement of ransomware further escalated the severity, as it indicated malicious intent to encrypt and potentially exfiltrate data for extortion.The incident underscored vulnerabilities in Smile Brands Inc.’s cybersecurity defenses, raising concerns about compliance with healthcare data protection regulations (e.g., HIPAA) and the company’s ability to safeguard patient information. The breach not only jeopardized customer trust but also exposed the organization to legal liabilities, regulatory fines, and reputational damage.