MMG Fusion Data Breach (2020): What Was Exposed & What To Do

In December 2020, MMG Fusion, a dental practice management service, was the subject of a data breach that exposed records associated with roughly 2.7 million people. The incident was reported on December 20, 2020, and involved 2.6 million unique email addresses along with additional patient details. The exposure is significant because the records contained information routinely used for identity verification, appointment scheduling, and direct contact, creating potential for misuse even years after the event.

Breaking down the breach

The breach was publicly reported on December 20, 2020. Available information indicates that 2.6 million unique email addresses were present in the data, together with patient appointments, names, phone numbers, dates of birth, genders, and physical addresses. A small number of records also contained passwords stored as bcrypt hashes. No further details on the timing or method of the intrusion have been disclosed in public reporting.

How a breach like this happens

Incidents involving healthcare-adjacent service providers often begin with the compromise of internet-facing systems such as web portals, databases, or third-party integrations. Once initial access is obtained, attackers may locate and copy stored records before detection. In many cases the precise entry point remains undisclosed, and the volume of data involved reflects the scale of records maintained by organizations that coordinate appointments and patient communications across multiple practices.

About MMG Fusion

MMG Fusion provides practice-management software to dental offices. Such platforms commonly store patient contact information, scheduling data, and basic demographic fields to support appointment booking and reminders. A breach at a service of this type is consequential because the records can span numerous independent dental practices, concentrating personal information from a wide geographic area in a single location.

The information in question

The disclosed data types include appointments, names, phone numbers, dates of birth, genders, physical addresses, and email addresses. A limited subset of records also contained passwords stored as bcrypt hashes. Marital status appears in some summaries of the incident, though confirmation of its presence across the full dataset remains limited. The exact scope of every field in every record has not been publicly detailed beyond these categories.

The real-world impact

Individuals whose information was exposed face the possibility of increased unsolicited contact and attempts to leverage the data for account access elsewhere, particularly where email addresses and dates of birth can support further targeting. Organizations that rely on the service may encounter follow-on administrative and regulatory obligations. Because the passwords were stored as bcrypt hashes, the immediate risk from those fields is lower than from plaintext credentials, though any reuse of the same password on other sites remains a separate concern.

If your data was in this breach

Review any email accounts associated with dental appointments for unusual activity and consider changing passwords on services where the same credentials may have been reused. Enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.