Beachwood, October 2 — Saber Healthcare, a skilled nursing and rehabilitation provider based in Beachwood, Ohio, began notifying individuals on October 1, 2026, about unauthorized access to one of its computer servers first identified on July 27, 2026. The breach, investigated with third-party cybersecurity experts, may have exposed names combined with date of birth, driver’s license or state ID numbers, health insurance information, medical information, financial account information, passport numbers, and/or Social Security numbers.
By August 19, 2026, the server review was completed and up-to-date address information was obtained for mailing notification letters. Although no evidence of data misuse was found, affected individuals were advised to remain vigilant against identity theft and fraud.
The number of affected individuals has not been publicly disclosed, but disclosures to state attorneys general indicate more than 3,000 individuals were impacted. Separately, Buchalter, LLP, a California-headquartered law firm providing legal services to Arrowhead Regional Medical Center in Colton, California, discovered on August 28, 2026, that limited patient data was accessed by an unauthorized third party. An internal investigation, assisted by third-party cybersecurity experts, confirmed on September 4, 2026, that certain ARMC patients’ data was compromised, and contact information was obtained by September 21, 2026, to mail notification letters.
At the time of notification, no misuse of the affected data had been identified. The specific data types involved were detailed in individual notification letters, and Buchalter stated it had taken steps to improve data security to prevent future incidents.
The number of affected individuals in the Buchalter incident has not been publicly disclosed. Bright Smile Dental Care, a Fishers, Indiana-based dental practice, experienced a ransomware attack on August 3, 2026, targeting a server containing practice management, dental imaging, and electronic health record software. Third-party cybersecurity experts were engaged to investigate and mitigate the impact.
The practice stated that patient data on the server was encrypted and that decryption keys were not believed to have been obtained by the ransomware group. While unauthorized data access was considered unlikely, the server contained names, dates of birth, addresses, email addresses, phone numbers, insurance information, information about dependents, health information, and in some cases, Social Security numbers. Notification letters were mailed to affected individuals, and complimentary credit monitoring services were offered to those whose Social Security numbers were present on the server.
The number of affected individuals in this incident has not been publicly disclosed. All three incidents were reported by Steve Alder, editor-in-chief of The HIPAA Journal, who has 10 years of experience writing about HIPAA and healthcare regulatory affairs and holds a Bachelor’s of Science degree from the University of Liverpool.
As ever, the technical reality is that even encrypted systems and segmented networks can leave administrative doors ajar — under the hood, it’s often the overlooked credential or delayed patch that becomes the vector. Looking ahead, regulators and providers alike will be watching whether these disclosures prompt faster adoption of zero-trust architectures in healthcare IT, particularly around legacy server environments.
