San Bernardino County Medical Center Breach Exposes Patient Data

San Bernardino County, operating Arrowhead Regional Medical Center (ARMC), disclosed a data security incident to the California Attorney General on September 28, 2026. The breach occurred on August 28, 2026, and affected patient information held by the major public teaching hospital.

The compromised data included a comprehensive range of sensitive details: Full Name, Date of Birth, Social Security Number, Medical Record Number, Health Insurance ID Number, Diagnosis and Treatment Information, Prescription Information, and Provider and Treatment Dates. This combination of identifying and health-related information is particularly valuable to malicious actors.

Such an exposure creates significant and lasting dangers for those affected. The combination of Social Security Numbers with other personal identifiers can facilitate severe financial identity theft, fraudulent loan applications, or tax fraud. Additionally, the exposure of medical data risks medical identity theft, where unauthorized individuals might use your information to obtain healthcare services, leading to inaccurate medical records and potential harm to your future care.

Healthcare providers like Arrowhead Regional Medical Center are legally obligated under federal laws like HIPAA and California state regulations to protect patient data with robust security measures. A widespread data breach suggests these essential safeguards may have been inadequate, indicating a potential failure in their duty to secure sensitive information.

If you received a data breach notification letter from San Bernardino County or Arrowhead Regional Medical Center, it confirms that your private information was compromised. This notification is a critical step, establishing your eligibility to consider legal action. You do not need to prove that fraud has already occurred; the increased risk and the burden of constantly monitoring your credit and medical records are recognized as legitimate injuries.

Our firm is actively monitoring this data breach and investigating potential class action claims on behalf of affected individuals. We offer a free, no-obligation case review to help you understand your legal rights and options.