Palomar Health Medical Group (PHMG), a California-based primary and specialty care provider, experienced a severe cybersecurity breach in October 2025. An unauthorized actor gained access to highly sensitive patient data, compromising a vast array of personally identifiable information (PII) and protected health information (PHI). The exposed records included critical identifiers such as Social Security numbers, passport details, military IDs, biometric data, financial account information (including payment cards and health savings accounts), and comprehensive medical histories (diagnostic/treatment records, Medicare/Medicaid IDs, and insurance data). The breach also exposed login credentials (usernames, passwords, and email addresses), heightening risks of identity theft, financial fraud, and further cyber exploits. The incident prompted a legal investigation by Lynch Carpenter, LLP, with affected individuals potentially eligible for compensation. The scale and sensitivity of the leaked data—spanning financial, health, and governmental identifiers—pose grave threats to patient privacy, financial security, and trust in the healthcare provider.

Palomar Health Medical Group Suffers Major Data Breach Affecting Thousands Between April 23 and May 5, 2024, Palomar Health Medical Group (PHMG), operating as Arch Health Partners Inc., experienced a significant data breach after an unauthorized actor gained access to its computer systems. The intrusion was detected on May 5, 2024, marking the final day of unauthorized access. An investigation concluded on September 4, 2025, revealed that the breach exposed highly sensitive data, including personally identifiable information (PII) and protected health information (PHI). Compromised records may contain names, addresses, dates of birth, Social Security numbers, driver’s license details, financial account information, medical histories, insurance data, and login credentials. The breach spanned multiple locations, affecting current and former patients across several states, with at least 374 individuals in Massachusetts confirmed impacted though the total number is expected to be far higher. The severity of the breach lies in the breadth of exposed data, which could facilitate identity theft, medical fraud, and financial exploitation. Notifications were filed with the Massachusetts and California Attorneys General on October 15, 2025, and affected individuals began receiving mailed notices the same day. In response, PHMG is providing complimentary credit monitoring and identity restoration services through Experian, including daily credit monitoring, identity theft insurance, and restoration assistance. The organization has also advised impacted individuals to monitor their accounts and credit reports for suspicious activity over the next 12 to 24 months.