Colorado Dental Wellness Center Listed by anubis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Colorado Dental Wellness Center was listed by the anubis ransomware group on May 01, 2026 after internal files were exfiltrated in a ransomware attack; the number of people affected has not been disclosed. Individuals should check whether their information was exposed and take steps to protect themselves.
Inside the incident
The only confirmed public information is the May 1, 2026 listing itself. The entry describes a ransomware attack in which internal files were allegedly exfiltrated. No date of the intrusion, volume of data, or method of access has been disclosed. The organization has not issued a public statement confirming or denying the claims, and the total number of people whose records may be involved is not known.
The group behind it: anubis
Anubis is a ransomware operation that has been publicly tracked for several years. Like other groups in this category, it typically gains access through common entry points such as remote desktop services or phishing, deploys encryption on victim systems, and removes copies of selected files. The group maintains a leak site where it lists organizations and posts samples of data to pressure victims into payment. In this case the group claims Colorado Dental Wellness Center is among its targets, but that claim has not been independently verified beyond the listing.
About Colorado Dental Wellness Center
Colorado Dental Wellness Center provides routine and specialized dental services to patients in Colorado. Organizations of this type routinely collect and store names, dates of birth, addresses, insurance details, medical histories, treatment notes, and billing records. A breach at a dental practice is consequential because the records contain both health information protected under federal regulations and financial identifiers that can be used for fraud.
What was likely exposed
The listing states that internal files were exfiltrated during a ransomware attack. No inventory of file types or record counts has been published. Dental practices commonly hold patient identifiers, clinical notes, radiographs, insurance claims, and payment information, but the exact contents of the exfiltrated material remain unconfirmed.
The real-world impact
Individuals whose records were among the files face the possibility that their health and financial details could be used for identity theft, insurance fraud, or targeted scams. The organization may incur costs related to investigation, notification, and regulatory review. Because the number of affected people and the precise data elements are still unknown, the full extent of these risks cannot yet be measured.
What to do if you're exposed
Anyone who has been a patient at the practice should monitor statements from the organization and consider placing a fraud alert with one of the major credit bureaus. Review insurance explanations of benefits for unexpected claims and change passwords on any patient portals. A short list of immediate steps includes:
- Request a free credit report and review it for unfamiliar accounts.
- Enable multi-factor authentication on financial and health-related accounts.
- Watch for unsolicited communications that reference dental treatment or insurance.
Readers can also run a free exposure scan of their email address against known breach data to see whether their information has appeared in previously published datasets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Quest Healthcare Solutions Listed by anubis Ransomware GroupBOSTON ORTHOTICS, INC. Listed by anubis Ransomware GroupQuest Health Solutions Listed by anubis Ransomware GroupSinging River Health System Listed by anubis Ransomware GroupLatest breaches
Publicly posted by anubis — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.