Data Breaches Announced by Saber Healthcare & Buchalter
Data breaches have been announced by Saber Healthcare in Ohio and Buchalter, a California-headquartered law firm that provides services to Arrowhead Regional Medical Center. Bright Smile Dental Care in Indiana has fallen victim to a ransomware attack, although unauthorized access to patient data is considered unlikely.
Saber Healthcare
Saber Healthcare, a Beachwood, Ohio-based skilled nursing, long-term, and senior rehabilitation care provider, has started notifying individuals about unauthorized access to one of its computer servers. The incident was identified on July 27, 2026, and immediate action was taken to secure its systems and prevent further unauthorized access. Third-party cybersecurity experts were engaged to assist with the investigation, which indicated that data stored on the server may have been accessed or acquired.
On August 19, 2026, the review of the server was completed, and up-to-date address information was obtained to allow notification letters to be mailed. Data compromised in the incident varies from individual to individual and may include names in combination with one or more of the following: date of birth, driver’s license/state issued identification number, health insurance information, medical information, financial account information, passport number, and/or Social Security number.
Additional network security measures have been implemented, and data security policies and procedures are being reviewed. No evidence has been found to indicate any misuse of the exposed data; however, the affected individuals have been advised to remain vigilant against identity theft and fraud. The number of affected individuals has yet to be publicly disclosed, although based on disclosures to state attorneys general, the incident has affected more than 3,000 individuals.
Buchalter, LLP (Arrowhead Regional Medical Center)
Patients of Arrowhead Regional Medical Center (ARMC) in Colton, California, have been affected by a cybersecurity incident at the law firm Buchalter, LLP. Buchalter provides legal services to the hospital and was provided with limited patient data in connection with those services. On August 28, 2026, Buchalter discovered that limited data was accessed by an unauthorized third party. An internal investigation was launched, with assistance provided by third-party cybersecurity experts to determine the nature and scope of the unauthorized activity.
On September 4, 2026, it was confirmed that certain ARMC patients had data compromised in the incident, and on September 21, 2026, contact information was obtained to allow notification letters to be mailed. At the time of issuing the notification letters, no misuse of the affected data had been identified. The data types involved are detailed in the individual notification letters. Buchalter said it has taken steps to improve data security to prevent similar incidents in the future. The number of affected individuals has not yet been publicly disclosed.
Bright Smile Dental Care
Bright Smile Dental Care, a Fishers, Indiana-based dental practice, has experienced a ransomware attack involving a server containing its practice management, dental imaging, and electronic health record software. The incident was identified on August 3, 2026, and third-party cybersecurity experts were engaged to investigate the incident and mitigate its impact.
Bright Smile Dental Care said patient data on the server was protected with encryption, and the keys to decrypt the data are not believed to have been obtained by the ransomware group. While there is a low likelihood of unauthorized data access, patients have been warned that the server contained their names, dates of birth, addresses, email addresses, phone numbers, insurance information, information about dependents, health information, and in some cases, Social Security numbers.
Notification letters have been mailed to the affected individuals, and complimentary credit monitoring services have been offered to individuals whose Social Security numbers were present on the server. The number of affected individuals has yet to be publicly disclosed.
