Archer Health 2025 Data Breach

The primary source is the “Notice of Data Privacy Incident” published on Archer Health's own website. It describes the September 7 date, unauthorized access on a third-party provider server, unaffected Archer systems, possible data fields, identity monitoring, termination of the provider relationship, and the 833-779-5787 assistance line.

The second source is the official HHS/OCR row dated November 6 for 4,285 people. A public breach source's incident page connects the same organization notice and HHS total.

Archer learned September 7 that an IT service provider supporting certain systems it uses had experienced a cybersecurity incident. An unauthorized person accessed the provider's server where patient data was stored. Archer said it began an investigation with cybersecurity experts and took steps to contain the event and safeguard patient information after learning of it.

The organization does not disclose the actor's first access date, duration, or technical method. The incident date is based on the earliest technical activity that can be verified from public sources. November 6 is the notification stage when patient letters began to be mailed and the HHS report was made.

The official notice explicitly says the incident did not involve Archer Health's own systems or networks. The affected environment was the third-party IT provider's server. This distinction is important for understanding the technical source of a healthcare breach reported under Archer's name.

It does not say that Archer's network was compromised or its systems encrypted. The vendor-originated incident was reported by Archer because patient data associated with its services was affected.

According to Archer's investigation, files varied by individual but may have included a name, date of birth, Social Security number, and limited medical information about healthcare the patient received. It should not be assumed that every field was present for every person or that all information was misused.

Individual letters are the primary source for determining which fields were associated with each patient. Additional sensitive information should not be supplied in an unexpected message even when it names the incident.

4,285 is the affected-person count published in the HHS/OCR portal; it is not a file, data-row, or provider-account count. The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person.

The organization notice does not publish an aggregate count, so the official total comes from the federal regulator row. If the same provider incident produces separate notices for other customers, those figures are not added to Archer's total without evidence. Each customer event should be evaluated through its own official regulatory scope.

Archer said it ended its relationship with the third-party provider and implemented enhanced controls for vendor security and monitoring. Patients whose Social security numbers may have been involved were offered complimentary identity monitoring. The organization also recommends checking healthcare statements for charges related to services not received.

The toll-free call center at 833-779-5787 is available weekdays from 6:00 a.m. to 6:00 p.m. Pacific Time. Recipients should check their own letters for monitoring enrollment terms, review healthcare statements, and verify unfamiliar services with the healthcare entity or insurer. A full SSN, password, or one-time code should not be shared. If a suspicious message or account event appears, it should be verified through the organization’s current official contact channel without using links in the message. When an individual notification letter is available, it is the primary source for the person-specific data scope and protection options offered. Dates and data categories should be interpreted only to the extent supported by public sources; undisclosed details should not be treated as confirmed. Regular review of credit, financial, and healthcare accounts can help identify possible misuse early.