Choosing The Right Dental Billing Partner After a Security Scare
Key Takeaways
- The picture is still developing. DireWolf listed eAssist on September 6, and the 26 GB claim has yet to be independently verified.
- “Developing” isn’t the same as “safe,” since final breach counts routinely exceed first reports.
- Billing vendors are prime targets because one intrusion can expose hundreds of practices, as Delta Dental of California and DentaQuest showed.
- You’re still on the hook under HIPAA, with a valid BAA and 60-day notification requirement.
- Cash flow feels it first, as missed timely-filing deadlines turn revenue into write-offs.
- Switching vendors changes the team, not the foundation, and a well-run transition takes about two weeks.
- Interview every partner the same way: SOC 2 Type II, a signed BAA, MFA, an incident response plan, and clear exit terms.
Introduction
If your dental practice uses eAssist Dental Solutions for billing, you have probably spent part of the past month reading vendor emails, forwarding news links to your office manager, and wondering whether eAssist is safe and what any of it means for your Monday morning. You didn’t sign up to become a cybersecurity expert. You signed up to treat patients and get paid for it.
This guide is for practice owners and office managers who want a straight answer to a practical question: if we decide to leave, what actually happens when we switch dental billing services? Before we get there, we’ll cover what has been publicly reported about the eAssist Dental Solutions breach claim, where the confirmed facts end and the attacker’s claims begin, and how this fits into a run of dental data breaches going back to 2020. Then we’ll walk through what changes and what stays the same when a practice moves its billing to TransDontics as an eAssist alternative.
One note on how this article handles the facts. Much of what has circulated about eAssist comes from the group that claims to have attacked it. We’ll say so every time. Where something is unconfirmed, it is labeled unconfirmed. Your decision should rest on what’s verified, and on what a switch would do for your cash flow and your compliance position.
The Short Answer
What was reported? On September 6, 2026, a ransomware group called DireWolf added eAssist Dental Solutions to its dark web extortion site and claimed to have stolen company data.
What did eAssist say? On September 8, 2026, eAssist told customers it was investigating a potential information security incident and had engaged outside forensic experts. It has not confirmed whether customer or patient information was accessed.
What does the attacker claim? DireWolf’s posting alleges about 26 GB of data across roughly 213 database tables and about 12.8 million rows. The categories named include patient billing and insurance records, banking and payment details, employee and applicant information, and stored credentials for insurance portals and practice software. Neither eAssist nor its parent company, Henry Schein, has confirmed those figures.
What changes if you switch from eAssist to TransDontics? Your billing team, your reporting, your security documentation, and your fee structure. Most practices notice the difference in the first month’s reports.
What doesn’t change? Your practice management software, your workflows at the front desk, your payer relationships, and your patients’ experience.
What We Know About the eAssist Data Breach Claim
eAssist Dental Solutions is a Utah-based outsourced billing and revenue cycle management company. It handles insurance claims, eligibility verification, patient billing and credentialing for dental offices across the country, and it’s majority-owned by Henry Schein. Because it sits between practices, payers, and patients, it holds a slice of a great many dental offices’ financial and insurance information.
The public record so far is short:
September 6, 2026: DireWolf lists eAssist on its leak site. In a double-extortion attack, criminals steal data first, then publicize the victim’s name and threaten to release the files unless they’re paid.
September 8, 2026: eAssist notifies customers of a potential security incident and says outside experts are investigating.
Mid-September 2026: Law firms begin announcing investigations into possible class actions. As of the latest public reporting, no matching entry has appeared in the federal HHS breach notification portal.
Two cautions follow from that timeline.
First, a leak-site listing is a claim, not proof. Some breach trackers tag this listing as “confirmed exfiltration,” but that label reflects the tracker’s classification of the attacker’s own post. It is not a finding from eAssist or from an independent forensic team.
Second, “unconfirmed” doesn’t mean “harmless.” Large breaches usually take months to scope. In several dental cases, the final number of affected people was many times larger than the first figure filed with regulators. Waiting for a final verdict before making any plan means waiting a long time, with your claims, your filing deadlines, and your patient relationships all depending on a vendor that is busy responding to an emergency.
If you are asking whether eAssist is safe, the honest position is this: whether eAssist’s systems were compromised, and how, is exactly what its investigation is meant to determine. What’s already clear is that a major dental billing vendor was publicly named by a ransomware group. That alone has put its customers in a position where they need answers, and where some of them want options.
Why Dental Billing Companies Attract Attackers
Criminals follow value and leverage. A billing company gives them both.
A single dental office holds a few thousand patient files. A billing company serving hundreds or thousands of offices holds a portion of every one of them, in a form that’s unusually useful. A typical billing record can contain a patient’s full name, date of birth, address, Social Security number or subscriber ID, insurance member and group numbers, procedure codes, explanation of benefits documents, account balances, and in some cases bank or card details. Identity, health, and financial information sit together in one place. That’s what makes the data good for identity theft, insurance fraud, and very believable phishing messages.
Then there are credentials. To do their jobs, billing teams hold logins to practice management systems, clearinghouses, and many payer portals across many practices. Stolen credentials do more than expose information. They provide access. Someone signing in as a billing office might be able to view claims, submit fraudulent ones, or try to redirect payments. It’s one reason the “stored credentials” category in DireWolf’s claim drew so much attention from practice managers, even though that claim is unverified.
Concentration is the last piece. When a vendor is the target, one intrusion can yield data from many practices. Your own firewall, your staff training, and your locked server room can’t protect information that lives on someone else’s systems.
Healthcare pays heavily for this. IBM’s annual Cost of a Data Breach report has ranked healthcare as the costliest industry for breaches for over a decade, and its 2025 edition put the average healthcare breach at roughly $7.4 million, with some of the longest detection and containment times of any sector.
A Pattern, Not an Accident: Dental Data Breaches in the Past Decade
Delta Dental of California (2023)
DentaQuest (2026)
DentaQuest, a dental and vision benefits administrator, suffered a network intrusion between May 17 and May 20, 2026, which the ShinyHunters group claimed. The company confirmed 15 million affected individuals to HHS, with estimates running as high as 23.4 million. It is the largest healthcare breach reported so far in 2026, and it happened inside the dental ecosystem.
The eAssist Claim (2026)
What the pattern shows
- Scale keeps climbing: Confirmed dental-sector incidents have gone from about one million affected people in 2020 to fifteen million or more in 2026.
- The vendor is the common thread: Support organizations, benefits administrators, IT providers and software suppliers appear in every confirmed case. The exposure sits one layer behind the dental office.
- The data is unusually sensitive: Dental billing and benefits records often pair Social Security numbers, government IDs, bank details, and health information in the same file.
- Answers arrive slowly: In several cases, confirmation took two to five months, and the final count ran well above the first number reported. An unresolved status today says little about how the story ends.
For a practice owner, the takeaway is simple. Choosing a billing company means choosing a security posture. Price, speed, and familiarity matter, but they can no longer be the only criteria.
What a Vendor Incident Does to Your Cash Flow and Compliance
Security headlines tend to focus on patient data. Practice owners tend to feel it first in the bank account. Let’s discuss how it affects cash flow and compliance.
The cash flow side
- Delayed submissions: If a vendor slows operations while responding to an incident, claims wait in a queue. Each day of delay pushes payment further out, and many practices run on modest working-capital cushions.
- Timely-filing exposure: Payers enforce filing windows, and some are strict. New York Medicaid fee-for-service dental claims, for example, generally must be submitted within 90 calendar days of the date of service, and late claims are usually unrecoverable. A disruption that isn’t caught early can quietly turn valid receivables into write-offs.
- Slipping follow-up: Denials, underpayments, and aged claims need steady, daily attention. When a vendor’s team is pulled toward incident response, routine follow-up is the first thing to slide, and older receivables collect at much lower rates than fresh ones.
- Access changes: If credentials or portal access are called into question, payers and banks may add verification steps. Those safeguards protect you, but they can interrupt deposits.
- Unplanned costs: Legal advice, patient communication, insurer notices and staff time all arrive at once.
To size your own exposure, divide your average monthly collections by 30 for a daily figure, then multiply by the number of days your billing could realistically stall. A practice collecting $150,000 a month faces $150,000 of delayed cash in a 30-day stall, before counting any claims that age past filing limits.
The compliance side
- Vendors are business associates: A billing company acting on your behalf is a HIPAA business associate. Since the HITECH Act and the 2013 Omnibus Rule, business associates have been directly subject to the Security Rule and parts of the Privacy Rule. Your practice, as the covered entity, remains responsible for vetting vendors and holding a valid Business Associate Agreement (BAA).
- Notification clocks are strict: Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. Breaches affecting 500 or more people require simultaneous notice to HHS and, in the relevant states, prominent media notice. State laws add their own deadlines.
- Risk analysis has to include vendors: HIPAA requires an accurate, thorough assessment of risks to electronic protected health information. The HHS Office for Civil Rights has taken enforcement action over missing or inadequate risk analyses, including against smaller organizations.
- The rules are tightening: HHS published a proposed update to the HIPAA Security Rule in January 2025 that would, if finalized, turn measures like multi-factor authentication and encryption into firm requirements and strengthen vendor oversight.
- Litigation moves fast: Law firms announced eAssist investigations within days, before the scope was known. Earlier dental cases ended in real money: $3 million for Dental Care Alliance and $3.3 million for Absolute Dental. Even when a practice isn’t the target, being named in a chain of defendants costs time and attention.
You can delegate work. You can’t delegate responsibility. What you can do is pick a partner that makes your responsibility easier to carry.
What Changes When You Switch
What changes
1.The team working your claims.
Your account is picked up by a new group of billing specialists. TransDontics states that it has more than 1,100 CDT-certified billing specialists and serves over 500 practices. The people who verify eligibility, submit claims, post payments, and chase denials will be different, and you’ll get a point of contact who knows your practice.
2. The security documentation you can ask to see.
TransDontics states that it is HIPAA compliant, SOC 2 Type II compliant, and ISO 27001 certified; that it signs a BAA with every practice before touching patient data, and that it encrypts data in transit and at rest. The SOC 2 Type II detail matters most. A Type II report is an independent auditor’s opinion on whether security controls actually worked over a period of months. It turns “we take security seriously” into something you can request and read. You should ask for the documentation from any vendor, TransDontics included.
3. How claims quality is measured.
TransDontics reports a 98% first-pass clean claim rate, against an industry average of about 82%. Every claim that clears on the first try gets paid sooner and doesn’t require a rework cycle. Ask any prospective partner for its own figure and how it’s calculated.
4. Denial handling.
The company describes 48-hour denial management, line-by-line reconciliation of payments against your contracted rates, and aged A/R recovery that includes claims past 90 days. If your current setup lets denials sit, this is often where the first visible improvement comes from.
5. Reporting.
Expect daily, weekly and monthly reports covering claims submitted, payments posted and receivables movement. Plenty of practices tell us they didn’t realize how little they were seeing until they saw more.
6. Your commercial terms.
TransDontics states that it charges 4% to 7% of collected revenue, with no setup fees, no monthly minimums and no long-term contracts. It gets paid when you get paid. If you’re locked into a long contract now, check your current notice and termination terms before you act, and have your attorney review them.
7. Credentialing support.
The company lists credentialing among its services, including CAQH maintenance, so enrollment tasks don’t fall between two vendors during the handoff.
What doesn't change
1. Your practice management software.
TransDontics says its specialists work natively inside your existing system, including Dentrix, Eaglesoft, Open Dental, Curve Dental, DentiMax, Carestream, iDentalSoft, Oryx, tab32 and Dentrix Ascend, among others. No data migration. No new platform to learn. There’s a security angle here too: when billers work in your system, less patient data has to be copied onto outside servers.
2. Your front desk routine.
Scheduling, check-in, treatment presentation and payment collection at the chairside all stay as they are. Your staff keeps doing what they do best.
3. Your payer relationships and contracts.
You remain in network with the same payers. Fee schedules stay yours. The new team works within them.
4. Your patients’ experience.
Most patients never know a vendor change happened. If statement formatting changes, a short heads-up from your front desk covers it.
5. Your ownership of your data.
Your claims history and your patient records are yours. A good transition partner treats them that way from day one.
What changes gradually
A Realistic Transition Timeline
Days 1 to 2: Conversation and paperwork
Days 2 to 4: Access and baseline
Days 4 to 7: Reconciliation
Days 7 to 10: Parallel oversight
Days 10 to 14: Full ownership
Days 14 to 90: Optimization
What to do if your billing vendor is breached
A few steps are worth doing yourself, whichever vendor you use:
- If your billing vendor is breached, or you’re just worried it might be, a few steps are worth doing yourself, whichever vendor you use.
- Pull an aging report the day you decide to move, so you have a baseline.
- List claims near filing deadlines and flag them for manual review.
- Reset credentials for payer portals and practice management logins. Use named user accounts instead of shared logins, and turn on multi-factor authentication wherever it’s offered.
- Verify that bank and EFT details on file with payers haven’t changed without your knowledge.
- Request your data from the outgoing vendor: claim history, denial logs, payment posting reports, credentialing records, and appeal history. Check your BAA for its return-or-destroy language.
- Talk to your bank about liquidity if you expect a short slowdown.
What Happens to Your Open Claims?
It’s the question that keeps more practices from moving than any other, so it gets its own section.
Claims fall into three groups during a switch.
- Claims already paid or posted: Nothing changes. They’re history.
- Claims submitted and pending: These are in the payer’s hands. Your incoming team reconciles them against your practice management data, tracks their status, and follows up with payers as needed. Payments that arrive after the switch still need to be posted correctly, which is why the reconciliation step matters.
- Claims not yet submitted: These are the most time-sensitive, especially near filing deadlines. The new team prioritizes them by deadline and value, and submits clean versions.
The failure points in transitions are duplicates, gaps, and misposted payments. All three are avoided the same way: a written baseline, a clear cutover date, and one person on each side who owns communication. If a vendor can’t describe how it handles these three groups, keep looking.
How to Judge Any Billing Partner After a Scare
Whether you choose TransDontics or someone else, use this checklist. It’s what a careful practice owner should ask before handing over system access.
- Independent proof: Ask for a SOC 2 Type II report, and note who performed the audit, what period it covers, and whether any exceptions were noted. ISO 27001 certification is another useful signal. HIPAA “compliance” alone is a self-description unless it’s backed by evidence, since there is no official government HIPAA certification.
- A signed BAA before access: With clear breach-reporting deadlines. Vague words like “promptly” leave you guessing.
- Encryption and access control: Data encrypted in transit and at rest, unique credentials for every user, multi-factor authentication, and role-based permissions.
- Where the work happens: Do billers work inside your system, or do they copy your data elsewhere? Less copying means a smaller target.
- Incident response: Ask to see the plan. How fast would they tell you? Who calls? How does billing continue during an outage? When was the plan last tested?
- People: Background checks, HIPAA training frequency, and how staff is tested against phishing.
- Financial alignment: A partner that pays a percentage of what it collects has a built-in reason to keep your claims moving.
- Exit terms: Can you leave with your data, without a penalty? Long lock-ins favor the vendor.
A vendor that welcomes these questions is showing you something valuable. One that dodges them is showing you something too.
Why Practices Are Choosing TransDontics
Practices looking for a dental billing company alternative usually want three things: security they can verify, performance they can measure, and a switch that doesn’t stall the schedule. TransDontics is built around those three, and it’s a dental-focused company.
- Verifiable security: SOC 2 Type II, ISO 27001, HIPAA compliance, and a BAA before access, all stated by the company and all things you can ask to review.
- Measurable performance: A reported 98% first-pass clean claim rate, 48-hour denial management, CDT-certified specialists, and reporting on a daily, weekly, and monthly basis.
- Low-risk economics: A fee of 4% to 7% of collections, and nothing due if nothing is collected. No setup fees, minimums, or contracts.
- Low-friction change: Native work inside your current software and a start within about 24 hours of access.
- Dental-only focus: Dental billing has its own coding (CDT), its own payer rules, its own attachment and narrative requirements, and its own rhythm of pre-authorizations. A team that does only this work spends its time on your problems rather than learning them.
We won’t pretend switching is right for every practice. If you talk to eAssist, get thorough written answers, and feel confident in what you hear, staying is a legitimate decision. But if the answers are thin, or your confidence in your current setup has been shaken, it makes sense to have a credible alternative already vetted. A conversation costs you nothing, and it gives you leverage in either direction.
See What a Switch Would Look Like for Your Practice
The Bigger Picture
For a long time, dental practices chose billing partners on price, speed and familiarity. Security was assumed. The record says otherwise: close to seven million at Delta Dental, fifteen million or more at DentaQuest, and millions of breached patient records across multiple practices and
DSOs. Now the alleged eAssist Dental Solutions breach is being investigated at one of the country’s larger dental billing companies.
Your patients trust you with their health and their finances. They’ll never see which vendor sits behind your front desk, but they will hold you accountable for what happens to their information. That’s why the billing partner you choose is one of the most consequential decisions in your practice.
You don’t need to wait for the final word on eAssist to plan your next step. Practices that come through moments like this well usually have one thing in common: they keep a credible alternative ready. Switching dental billing companies doesn’t have to mean disruption. Done well, it changes your team, your reporting, and your security documentation, and leaves everything your patients see exactly as it was.
Ready to Switch to TransDontics? Talk to a Dental Billing Specialist Today.
If your practice works with eAssist and you’d like a secure, no-contract eAssist alternative, TransDontics can review your setup, walk you through the transition, and have your team working inside your existing software fast.
Frequently Ask Questions (FAQs)
Was the eAssist data breach confirmed?
How much data is DireWolf claiming?
Are there dental precedents for vendor-side breaches?
Can my practice be held responsible for a vendor's breach?
Do I have to notify my patients if my billing vendor is breached?
How fast can I switch dental billing companies to TransDontics?
Will I need to change my software?
What does it cost?
What happens to my open claims?
What's the difference between HIPAA compliance and SOC 2 Type II?
Is eAssist safe to keep using, or should I leave right now?
Disclaimer: This article is provided for general informational purposes and does not constitute legal, financial, or compliance advice. Details about the eAssist Dental Solutions incident are based on publicly reported information as of late September 2026, are attributed to the source where they originate with the alleged attacker, and may change as the investigation develops. TransDontics service details are company-reported.
