Arrowhead Regional Medical Center Data Breach – Investigated by Federman & Sherwood
October 1, 2026 – Federman & Sherwood, a national consumer protection law firm, is investigating the Arrowhead Regional Medical Center data breach following a notification filed with the California Attorney General.
Arrowhead Regional Medical Center (“ARMC”) reported that the incident involved Buchalter, LLP, a law firm that provides legal services to ARMC and received a limited amount of ARMC patient information in connection with those services.
On August 28, 2026, Buchalter learned that a limited amount of its data had been acquired without authorization. Buchalter took steps to secure its systems and launched an investigation with third-party computer forensic specialists. The investigation determined that the incident was isolated and found no evidence that the unauthorized actor gained access to or impacted Buchalter’s network or systems.
On September 4, 2026, Buchalter determined that the affected data contained information belonging to certain ARMC patients and notified ARMC. Buchalter obtained the information necessary to provide notification on September 21, 2026. According to the notice, there is currently no evidence that the affected information was viewed by a third party or misused.
The information potentially affected included individuals’ names and additional personal information. The publicly filed sample notice does not identify the specific additional data elements involved.
Following the incident, Buchalter worked with third-party experts, reported the matter to law enforcement, and took additional steps intended to reduce the likelihood of a similar incident. ARMC also evaluated the incident and its impact on patients and reviewed Buchalter’s containment and security measures.
Buchalter and ARMC are offering affected individuals complimentary Experian IdentityWorks identity protection services. The services include credit monitoring, identity restoration assistance, Experian IdentityWorks ExtendCARE, and up to $1 million in identity theft insurance. The publicly filed notice does not specify the exact duration of the complimentary membership.
Federman & Sherwood is investigating whether Buchalter, Arrowhead Regional Medical Center, and other parties responsible for protecting the affected information maintained reasonable safeguards to protect sensitive patient information and whether additional measures could have prevented or reduced the impact of the data breach.
The potentially compromised information may include:
- Names
- Social Security numbers
- Other sensitive information
What is Arrowhead Regional Medical Center?
Arrowhead Regional Medical Center (ARMC) is a 456-bed public teaching hospital in Colton, California, operated by San Bernardino County to provide comprehensive medical, surgical, and emergency care.
Individuals affected by the Arrowhead Regional Medical Center data breach may have legal rights and are encouraged to contact Federman & Sherwood.
Phone: 1-800-237-1277 | Email: info@federmanlaw.com