Lumio Dental Data Breach Exposes Sensitive Personal and Health Information

Lumio Dental, a dental partnership organization headquartered in Tulsa, Oklahoma, disclosed a data breach that affected approximately 500 individuals in the United States.

The breach was disclosed to the U.S. Department of Health and Human Services on March 29, 2026.

On Feb. 5, 2026, the Nitrogen ransomware group posted a claim on the dark web. The compromised data reportedly includes passports, driver's licenses and extracts from medical records.

Lumio Dental's response to the breach

It is unclear from available sources whether Lumio Dental has sent individual notification letters to those whose information was compromised.

There is also no public information about whether Lumio Dental is offering credit monitoring or identity protection services to those affected.

Individuals with questions or concerns about this incident can contact Lumio Dental directly by phone at 800-614-0263.

Steps to take if your information was exposed

• Place a fraud alert or credit freeze with Equifax (1-800-525-6285), Experian (1-888-397-3742) and TransUnion (1-800-680-7289) to help prevent anyone from opening new financial accounts using stolen personal information.
• Request free credit reports at AnnualCreditReport.com and review them carefully for any unfamiliar accounts, hard inquiries or other suspicious activity that could indicate fraud.
• Report a compromised passport to the U.S. Department of State if passport information may have been exposed, as a stolen passport number could be used to create fraudulent identity or travel documents.
• Monitor health insurance statements closely for any unfamiliar services, claims or charges, since compromised medical records could be used to commit medical identity theft.
• Consider filing an identity theft report with the Federal Trade Commission at IdentityTheft.gov if there are any signs that personal information has been misused.
• Be cautious of phishing attempts that reference Lumio Dental or this data breach by name, as scammers frequently use real breach notifications to trick people into sharing additional sensitive personal information.