SUBSTITUTE NOTICE - NOTICE OF DATA BREACH

Posted: September 28, 2026

Arrowhead Regional Medical Center (“ARMC”) recently learned of a data breach incident involving Buchalter, LLP (“Buchalter”), a law firm that provides legal services to ARMC and had access to certain patient information in connection with those services.

What Happened?

On August 28, 2026, Buchalter learned that a limited amount of Buchalter data was subject to unauthorized acquisition. In response, Buchalter immediately took steps to confirm the security of its systems and commenced an internal investigation with the assistance of third-party computer forensic specialists to evaluate the scope of the incident. Buchalter has determined that this was an isolated incident and there is no evidence that the incident impacted Buchalter’s network or systems. Buchalter engaged data mining experts to perform a comprehensive review of the affected data.

On September 4, 2026, Buchalter discovered that a limited amount of ARMC information was contained within the impacted data set and notified ARMC that the incident involved information belonging to certain ARMC patients. Buchalter then worked with ARMC to identify contact information for the purpose of effectuating notice. ARMC’s systems and networks were not impacted by this incident.

Importantly, we have no evidence that the information has been viewed by any third-party or of any misuse of the impacted information as a result of this incident.

What Information was Involved?

The information involved in this incident may have included patient names, social security numbers, dates of birth, and other information relating to health insurance claims (such as medical record number, patient account number, dates of service, care setting or status (such as inpatient, outpatient, emergency, or observation) and diagnosis-related group (DRG) code number).

The data involved in the incident does not include full patient medical records, medical imaging, or financial information, such as credit card or bank account information.

What Are We Doing?

Upon discovering this incident, Buchalter immediately began an investigation with the assistance of third-party experts and took steps to confirm the security of the Buchalter systems. Additionally, Buchalter has taken steps to reduce the likelihood of a similar incident occurring in the future. Buchalter also reported this matter to law enforcement and will cooperate with any efforts to hold the perpetrator(s) accountable.

Upon learning of the incident, ARMC promptly began working with Buchalter to evaluate the incident and its impact on ARMC patients. ARMC reviewed information regarding Buchalter’s investigation, worked to identify the individuals and information affected, assessed the nature and scope of the incident, and coordinated appropriate notification and mitigation efforts. ARMC also reviewed the steps taken by Buchalter to contain the incident, strengthen its safeguards, and reduce the risk of a similar incident occurring in the future.

Buchalter and ARMC are also providing ARMC patients whose information was involved in this incident with information about steps that can be taken to help protect information and are offering such individuals complimentary identity protection services through Experian, a data breach and recovery services expert.

What You Can Do.

We encourage you to enroll in the identity protection services that Buchalter and ARMC are making available to you. You can also follow the recommendations included with this letter to help protect your information. We recommend that you review your current and past credit and debit card account statements for discrepancies or unusual activity. If you see anything that you do not understand or that looks suspicious, or if you suspect that any fraudulent transactions have taken place, you should call the bank that issued the credit or debit card immediately.

For More Information: If you have questions about this incident or the services offered to you, you may contact the dedicated assistance line at 866-566-1941between 6:00 a.m. and 6:00 p.m. Pacific Time (excluding major U.S. holidays).

The privacy and security of information is important to us, and we will continue to take steps to protect information in our care.

Sincerely,

Arrowhead Regional Medical Center

400 N. Pepper Avenue

Colton, California 92324-1819

Steps You Can Take to Help Protect Your Information

Review Your Account Statements and Notify Law Enforcement of Suspicious Activity: As a precautionary measure, we recommend that you remain vigilant by reviewing your account statements and credit reports closely. If you detect any suspicious activity on an account, you should promptly notify the financial institution or company with which the account is maintained. You also should promptly report any fraudulent activity or any suspected incidence of identity theft to proper law enforcement authorities, your state attorney general, and/or the Federal Trade Commission (the “FTC”).

Copy of Credit Report: You may obtain a free copy of your credit report from each of the three major credit reporting agencies once every 12 months by visiting www.annualcreditreport.com/, calling toll-free 1-877-322-8228, or by completing an Annual Credit Report Request Form and mailing it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348. You also can contact one of the following three national credit reporting agencies:

Fraud Alert: You may want to consider placing a fraud alert on your credit report. An initial fraud alert is free and will stay on your credit file for at least one year. The alert informs creditors of possible fraudulent activity within your report and requests that the creditor contact you prior to establishing any accounts in your name. To place a fraud alert on your credit report, contact any of the three credit reporting agencies identified above. Additional information is available at: www.annualcreditreport.com.

For TransUnion: www.transunion.com/fraud-alerts.

Security Freeze: You have the right to put a security freeze on your credit file for up to one year at no cost. This will prevent new credit from being opened in your name without the use of a PIN number that is issued to you when you initiate the freeze. A security freeze is designed to prevent potential creditors from accessing your credit report without your consent. As a result, using a security freeze may interfere with or delay your ability to obtain credit. You must separately place a security freeze on your credit file with each credit reporting agency. In order to place a security freeze, you may be required to provide the consumer reporting agency with information that identifies you including your full name, Social Security number, date of birth, current and previous addresses, a copy of your state-issued identification card, and a recent utility bill, bank statement or insurance statement. For TransUnion: www.transunion.com/credit-freeze.

Additional Free Resources: You can obtain information from the consumer reporting agencies, the FTC, or from your respective state Attorney General about fraud alerts, security freezes, and steps you can take toward preventing identity theft. You may report suspected identity theft to local law enforcement, including to the FTC or to the Attorney General in your state.

You also have certain rights under the Fair Credit Reporting Act (FCRA): These rights include to know what is in your file; to dispute incomplete or inaccurate information; to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information; as well as other rights. For more information about the FCRA, and your rights pursuant to the FCRA, please visit www.consumer.ftc.gov/sites/default/files/articles/pdf/pdf-0096-fair-credit-reporting-act.pdf.