Archer Health Data Breach 2025: 4,285 Affected · Hacking/IT Incident · CA. Filed With HHS OCR. What To Do.

Archer Health, a California-based in-home nursing and palliative care provider, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on November 6, 2025, reporting 4,285 affected individuals in a Hacking/IT Incident at a Network Server. The incident is tied to a broader exposure first surfaced in late summer 2025, when an independent security researcher found an unprotected Archer Health database on the open internet and the ransomware crew KillSec subsequently claimed responsibility on its dark-web leak site.

The OCR filing represents the entity’s own federal regulatory disclosure. The wider exposure reported in the security press involved a 23.7-gigabyte database with roughly 145,000 files, which is materially larger than the 4,285 individuals listed on the OCR portal. The relationship between the broader researcher-disclosed exposure and the narrower OCR filing has not been publicly reconciled by Archer Health.

Timeline

• Late August 2025 (approximate) — Independent cybersecurity researcher Jeremiah Fowler discovers a non-password-protected Archer Health database publicly accessible on the internet.
• September 4, 2025 — Fowler notifies Archer Health. The database is restricted from public access within hours.
• September 7, 2025 — The ransomware group KillSec (also styled KillSecurity / KillSec3) posts Archer Health on its dark-web leak site, claiming exfiltration of patient data.
• November 6, 2025 — Archer Health files a HIPAA breach notification with HHS OCR, reporting 4,285 affected individuals and classifying the incident as a Hacking/IT Incident at a Network Server.
• November 2025 onward — Archer Health begins individual notifications, opens a dedicated call center, and offers complimentary identity-monitoring services to affected individuals.

What was exposed

Based on the researcher’s review of the exposed database and Archer Health’s subsequent disclosures, the compromised data set has been reported to include:

• Names
• Dates of birth
• Social Security numbers
• Patient identification numbers
• Physical addresses
• Phone numbers
• Medical information, including diagnoses, treatment records, assessments, certifications, and care plans

The HHS OCR portal entry itself categorizes the location of the protected health information as Network Server and the type of breach as Hacking/IT Incident, without enumerating data elements.

What Archer Health is offering

Archer Health is offering complimentary identity-monitoring services to affected individuals and has established a dedicated call center for breach-related questions at 833-779-5787, available Monday through Friday, 6:00 a.m. to 6:00 p.m. Pacific Time. The duration of monitoring, the enrollment deadline, and the specific provider have not been independently confirmed on this page.

Class-action status

At least two plaintiffs’ firms — Schubert Jonckheer & Kolbe LLP and The Lyon Firm — have publicly announced investigations into the Archer Health breach and are soliciting affected individuals for potential representation. As of this writing, no formal complaint has been confirmed on the public docket on this page. We will update this section when filings appear.

What to do if you may be affected

• Freeze your credit with Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against new-account identity theft when a Social Security number has been exposed.
• Watch for a notification letter at the address Archer Health has on file for you. The letter will list the specific data elements exposed for your record and any complimentary monitoring offered, along with the enrollment code.
• Enroll in the offered identity monitoring if you receive a notice. It does not waive any legal rights and is free to you.
• Call 833-779-5787 if you believe you may have been a patient and have not received a letter.
• Be alert to phishing. Threat actors often use breach disclosures as cover for follow-on phishing or vishing. Archer Health will not ask you to verify your Social Security number by email or text.
• Bookmark this page. We update it as the OCR investigation progresses, as the relationship between the researcher-disclosed exposure and the OCR filing is clarified, and as any class-action filings appear on the docket.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Bank Info Security — 150,000 Records of Home Health Care Firm Exposed on Web
• TechRadar — Nearly 150,000 patient records exposed in major healthcare data breach
• Schubert Jonckheer & Kolbe — Archer Health Data Breach Investigation
• The Lyon Firm — Archer Health Data Breach Investigation
• HookPhish — KillSec Ransomware Group Hits Archer Health