Park Dental Partners Faces Four Class-Action Lawsuits Over August 2026 Data Breach; No Material Impact Identified On Financial Condition Or Results Of Operations To Date; Identifies Impacted Patients And Completes Notifications Under State And Federal Law; Identifies Unauthorized Network Access On August 28, 2026; Says Not Aware Of Unauthorized Use Of Protected Health Information Or Damages To Date

As previously reported, on August 28, 2026, Park Dental Partners, Inc. ("Company") identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, engaged external cybersecurity experts and forensic specialists and notified law enforcement. The investigation has determined that data was subject to unauthorized acquisition as a result of the incident. The Company has identified impacted patients whose protected health information was involved and is completing notifications pursuant to applicable state and federal law.

The Company is aware of four state court lawsuits related to the August 2026 data breach, the first of which was filed on September 3, 2026: Julienne Wyckoff, on behalf of himself and all others similarly situated v. Park Dental Partners, Inc. (62-CV-26-6341), Second Judicial District, County of Ramsey, State of Minnesota; Thomas Jahnke and Nathaniel Sonia, on behalf of themselves and all others similarly situated v. Park Dental Partners, Inc. (62-CV-26-6381), Second Judicial District, County of Ramsey, State of Minnesota; Norbu Lama, on behalf of himself and all others similarly situated v. Park Dental Partners, Inc. (62-CV-26-6384), Second Judicial District, County of Ramsey, State of Minnesota; and Becky Murphy and Debbie Palm, on behalf of themselves and all others similarly situated v. Park Dental Partners, Inc. (62-CV-26-7111), Second Judicial District, County of Ramsey, State of Minnesota.

Each lawsuit is a putative class action alleging the Company failed to safeguard patients’ protected health information or failed to implement reasonable security measures that resulted in the August 2026 data breach and increased the risk of identity theft. The lawsuits also allege that the Company failed to timely notify affected individuals. Claims include negligence, negligence per se, invasion of privacy, breach of fiduciary duty, unjust enrichment, breach of implied contract, and breach of confidence. The Company intends to vigorously defend its positions in the litigation. On October 7, 2026, the plaintiffs filed a motion to consolidate the four actions and appoint interim lead class counsel. The Company also anticipates regulatory responses. To date, the Company is not aware of any unauthorized use of protected health information or any damages as a result of the incident.

Security is a top priority for Park Dental Partners, Inc. and the Company continues to focus on protecting the privacy of protected health information in its care and mitigating cybersecurity risk, maintaining safeguards designed to protect data, continuously reviewing and enhancing those protections to address evolving threats, and providing ongoing and regular cybersecurity awareness training and testing for all employees. The Company maintains a cybersecurity risk-management program designed to assess, identify, and manage material risks arising from cybersecurity threats, consistent with the standards reported by peer companies in the dental and medical industries, which commonly leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as a basis for security posture measurement and risk management.

To date, the Company has not identified any material impact on its financial condition or results of operations as a result of this incident, including the current expected legal and advisor cost to address the incident.

To the extent additional information becomes available that could affect the Company’s assessment of the incident and its impact, the Company will update this disclosure in a timely manner.