San Bernardino County on behalf of Arrowhead Regional Medical Center data breach

Clerk's notes

San Bernardino County, acting for Arrowhead Regional Medical Center, filed notice of a data security incident on September 28, 2026. This breach, discovered on August 28, 2026, is currently under investigation with regulators monitoring its resolution.

The compromised information includes highly sensitive patient data such as Full Name, Date of Birth, Social Security Number, Medical Record Number, Health Insurance ID Number, Diagnosis and Treatment Information, Prescription Information, and Provider and Treatment Dates. This combination of personal and medical identifiers can lead to various forms of fraud and identity theft.

Such an exposure creates serious and lasting risks for those affected. Medical record numbers and health insurance IDs, when combined with diagnosis and treatment details, can facilitate medical identity theft, leading to false claims, corrupted health histories, and potentially dangerous medical care. The compromise of Social Security Numbers, coupled with other personal data, raises the risk of financial fraud, including unauthorized account access and new credit lines opened in victims' names.

Organizations entrusted with protected health information (PHI) and personally identifiable information (PII), like San Bernardino County and Arrowhead Regional Medical Center, are bound by stringent regulations such as HIPAA, HITECH, and California's data privacy laws. These laws mandate robust security measures to protect patient data. A breach of this nature suggests that these required safeguards may have been insufficient, potentially indicating a failure in the duty of care owed to patients.

If you have received a notification letter from San Bernardino County on behalf of Arrowhead Regional Medical Center, it confirms that your private information was compromised. This letter establishes your eligibility to seek recourse for the increased risk and burdens you now face. Victims are not required to prove immediate financial harm to pursue a claim; the inherent risk of future identity theft and the need for ongoing monitoring are recognized as legitimate injuries.

Our firm is investigating this data breach to determine how affected individuals can secure their rights. We handle these cases on a contingency fee basis, meaning there are no upfront costs, and we only collect a fee if we successfully recover compensation for you. Contact us for a free review of your case.

If a notification letter about this breach reached you, see every California data breach on file or browse all cases.