N0n Ransomware Claims Delta Dental of Missouri, With Member Social Security Numbers Exposed

A dental insurer joins the ransomware list

The Delta Dental breach claim landed on November 5, 2026, when the N0n ransomware group listed Delta Dental of Missouri as a victim. According to threat intelligence reports based on the group's leak site, the attackers claim to have read the customer relationship database of the dental benefits insurer, recovering 48,528 distinct email addresses and 17,913 telephone numbers.

The more serious part is what the group claims is inside those records. Member and subscriber service records are said to include full names, Social Security numbers, dates of birth, home addresses and dental treatment details. Employer group client records, with contacts, addresses and phones, and the insurance broker channel that serves them, are also listed as exposed. The listing carries a NOT PAID, EXPOSED status, which in ransomware leak-site language means the victim did not pay and the data is being published or offered.

None of this has been independently confirmed. These details come from threat intelligence feeds that track ransomware leak sites, and Delta Dental of Missouri has not, as of this writing, publicly confirmed a breach. Treat the claim as a claim, but take it seriously, because the details are specific enough to check.

N0n is having a busy month

This is not N0n's first appearance in the news. The same group recently claimed a breach at Michigan State University affecting 1.03 million records, and the pattern in both cases is familiar: steal the data first, then use the threat of publication as the lever. The group's earlier attacks have combined stolen credentials and AI-assisted tooling rather than relying on a single software flaw, which makes them harder to pin to one patch or one fix.

The choice of target matters too. A dental insurer holds exactly the kind of data identity thieves want: names tied to Social Security numbers, dates of birth and home addresses, all in one place, plus employer information that makes phishing emails easy to personalize. Health and dental records also tend to live in systems that were built for claims processing, not for the threat landscape of 2026.

What members should do now

If you are a Delta Dental of Missouri member, do not wait for an official letter. Start with the basics in our guide on what to do after a data breach, then work through this list.

First, assume your Social Security number may be exposed and place a credit freeze with the major bureaus. A freeze is free, it blocks new accounts from being opened in your name, and it is far stronger than a fraud alert. Second, watch for phishing. Attackers with your name, employer and dental details can write emails that look like they come from your dentist or your insurer, and the next wave of this attack is usually the inbox, not the database.

Third, change passwords on any account that shares a password with your insurer's portal, and turn on two-factor authentication where it is offered. The Sony So-net breach earlier this year showed how stolen credentials keep causing damage long after the first headline fades, and the Chainalysis incident showed that attackers now use AI agents to move fast once they are inside.

The pattern to watch

Ransomware groups have spent 2026 moving downmarket. The biggest headlines used to be hospitals and pipelines. Now the victim lists are full of insurers, schools, food banks and small manufacturers, organizations with valuable data and modest security budgets. The economics explain it: stealing a database and threatening to publish it costs the attacker almost nothing, and even a small chance of payment makes the attempt worthwhile.

That shift is bad news for everyone whose data sits in a mid-sized organization's systems, which is most of us. The defenses have not changed, they just matter more: patch promptly, segment networks, back up offline, and treat every employee's inbox as the front door. For Delta Dental members, the next step is a public statement from the company confirming what happened and what it is doing about it. Until then, freeze your credit and read every email twice.