A third-party dental marketing agency's unsecured database exposed millions of patient profiles with personal information that could be exploited for identity theft and insurance fraud.