On Nov. 6, 2025, Archer Health, a provider of onsite and on-demand healthcare services for businesses, reported a significant data breach to the U.S. Department of Health and Human Services. According to the official disclosure, the breach compromised personally identifiable information (PII) and protected health information (PHI) of at least 4,285 individuals across the U.S. The attack was first made public on the dark web on Sept. 7, 2025, when KillSec announced they had accessed Archer Health’s data and threatened to publish it within seven to eight days. The nature of the breach was classified as ransomware, indicating that attackers not only encrypted files but also exfiltrated data, a tactic increasingly used to pressure organizations into paying a ransom. Compromised information includes names, dates of birth, Social Security numbers and medical information. The exposure of both PII and PHI puts individuals at risk of identity theft and medical fraud. In addition to reporting the breach to relevant authorities, the company has posted a notice of data privacy incident on its website. Archer Health's response In response to the breach, Archer Health has notified the U.S. Department of Health and Human Services and begun the process of informing affected individuals. Because the breach involved ransomware and the threat of data publication on the dark web, those impacted should be vigilant for signs of identity theft, fraud or phishing attempts. It is recommended tha

Archer Health, a US-based provider of in-home and palliative care services, exposed 145,000 sensitive files (23GB) through an unprotected, publicly accessible database. The leaked data included patient names, Social Security Numbers (SSNs), diagnoses, treatment records, home health certifications, discharge forms, postal addresses, phone numbers, and other personally identifiable information (PII). The breach was discovered by cybersecurity researcher Jeremiah Fowler, who alerted the company, prompting them to secure the database. While no evidence of dark web distribution was found, the exposure posed severe risks due to the highly sensitive medical and personal data involved. The company acknowledged the incident, stating they take data security seriously and are investigating further. The duration of exposure and potential unauthorized access remain unknown.