SmilePoint Dental Group targeted by spacebears ransomware group

• Ransomware group: spacebears
• Country: United States
• Sector: Healthcare
• Announcement date: May 12, 2026

Spacebears claims data breach at SmilePoint Dental Group

The ransomware group known as spacebears has announced on its leak site that it has allegedly exfiltrated sensitive patient and financial data belonging to SmilePoint Dental Group. This announcement, made on May 12, 2026, suggests a significant breach of information involving a major healthcare provider. While the group has posted this claim on their leak site, the incident remains an allegation by the threat actor.

Ransomware groups often utilize leak sites to claim responsibility for attacks, a tactic frequently associated with double extortion. In such scenarios, attackers not only encrypt an organization's systems but also steal sensitive data to pressure the victim into paying a ransom by threatening to publish the information publicly. This method increases the leverage held by the cybercriminal group over the target organization.

Details of the alleged attack

According to the claims made by the spacebears threat actor, the compromise of SmilePoint Dental Group occurred on April 14, 2026. The group alleges that they successfully gained unauthorized access to the organization's internal systems during this period. Specifically, the attackers claim to have obtained access to the organization's EagleSoft database and various patient records.

The announcement suggests that the breach may have exposed data related to the company's dental clinic operations across multiple locations. The scope of the incident, as claimed by the group, appears to impact the data management of clinical operations spanning across Texas and New Mexico. The group's focus on data exfiltration indicates an intent to exert pressure on the organization through the threat of public disclosure.

Alleged compromised data types

The information allegedly leaked by the spacebears group includes a variety of sensitive records. The following data types have been identified in the group's claims:

• Social security numbers
• Patient medical histories
• Financial reports
• Database access credentials

The inclusion of database access credentials is particularly concerning, as it may present secondary attack vectors or supply chain risks if the credentials allow further movement within the network or into connected systems.

About SmilePoint Dental Group

SmilePoint Dental Group is a dental healthcare organization that operates numerous family dental clinics and orthodontics centers across Texas and New Mexico. They provide a wide range of comprehensive services, including general dentistry, orthodontics, cosmetic care, and implant treatments.

Potential impact and industry implications

This alleged breach may expose patients to significant risks, including identity theft and fraud, due to the sensitive nature of the stolen information. For the organization, the disclosure of health information could lead to serious legal and regulatory consequences under HIPAA regulations in the United States. The reported access to the EagleSoft database highlights the critical importance of securing specialized medical software used in dental practices.

If the breach is verified, the affected individuals may face long-term risks, such as targeted phishing attacks and other forms of identity-based fraud. For organizations operating in the healthcare sector, such incidents underscore the necessity of robust defensive measures. Common defensive steps for organizations include implementing multi-factor authentication, maintaining strict access controls for databases like EagleSoft, and ensuring comprehensive encryption for both data at rest and data in transit. Furthermore, regular monitoring for unauthorized access and maintaining offline, immutable backups are essential components of a modern cybersecurity posture to mitigate the impact of ransomware and data exfiltration attempts.