Data Breaches Announced by Saber Healthcare & Buchalter
Data breaches have been announced by Saber Healthcare in Ohio and Buchalter, a California-headquartered law firm that provides services to Arrowhead Regional Medical Center. Bright Smile Dental Care in Indiana has fallen victim to a ransomware attack, although unauthorized access to patient data is considered unlikely.
Saber Healthcare
Saber Healthcare, a Beachwood, Ohio-based skilled nursing, long-term, and senior rehabilitation care provider, has started notifying individuals about unauthorized access to one of its computer servers. The incident was identified on July 27, 2026, and immediate action was taken to secure its systems and prevent further unauthorized access. Third-party cybersecurity experts were engaged to assist with the investigation, which indicated that data stored on the server may have been accessed or acquired.
On August 19, 2026, the review of the server was completed, and up-to-date address information was obtained to allow notification letters to be mailed. Data compromised in the incident varies from individual to individual and may include names in combination with one or more of the following: date of birth, driver’s license/state issued identification number, health insurance information, medical information, financial account information, passport number, and/or Social Security number.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
Additional network security measures have been implemented, and data security policies and procedures are being reviewed. No evidence has been found to indicate any misuse of the exposed data; however, the affected individuals have been advised to remain vigilant against identity theft and fraud. Since this article was published, the HHS’ Office for Civil Rights has added the data breach to its data breach portal, showing the incident involved the protected health information of 282,727 individuals.
Buchalter, LLP (Arrowhead Regional Medical Center)
Patients of Arrowhead Regional Medical Center (ARMC) in Colton, California, have been affected by a cybersecurity incident at the law firm Buchalter, LLP. Buchalter provides legal services to the hospital and was provided with limited patient data in connection with those services. On August 28, 2026, Buchalter discovered that limited data was accessed by an unauthorized third party. An internal investigation was launched, with assistance provided by third-party cybersecurity experts to determine the nature and scope of the unauthorized activity.
On September 4, 2026, it was confirmed that certain ARMC patients had data compromised in the incident, and on September 21, 2026, contact information was obtained to allow notification letters to be mailed. At the time of issuing the notification letters, no misuse of the affected data had been identified. The data types involved are detailed in the individual notification letters. Buchalter said it has taken steps to improve data security to prevent similar incidents in the future. The number of affected individuals has not yet been publicly disclosed.
Bright Smile Dental Care
Bright Smile Dental Care, a Fishers, Indiana-based dental practice, has experienced a ransomware attack involving a server containing its practice management, dental imaging, and electronic health record software. The incident was identified on August 3, 2026, and third-party cybersecurity experts were engaged to investigate the incident and mitigate its impact.
Bright Smile Dental Care said patient data on the server was protected with encryption, and the keys to decrypt the data are not believed to have been obtained by the ransomware group. While there is a low likelihood of unauthorized data access, patients have been warned that the server contained their names, dates of birth, addresses, email addresses, phone numbers, insurance information, information about dependents, health information, and in some cases, Social Security numbers.
Notification letters have been mailed to the affected individuals, and complimentary credit monitoring services have been offered to individuals whose Social Security numbers were present on the server. The HHS’ Office for Civil Rights breach portal shows that the incident involved the protected health information of 7,601 individuals.
