ARcare data breach: what happened and what to do

ARcare, a healthcare provider in Arkansas, Kentucky and Mississippi, reported a malware attack affecting 345,353 patients. Names, Social Security numbers, dates of birth, diagnoses, medications and other treatment details were involved. Notice letters are dated April 25, 2022.

View all 13,177 breaches

Breach date: 18 Jan 2022
Affected: 345,353
Data exposed: Names, Physical addresses, Dates of birth, Social security numbers, Diagnoses, Medications, Treatment information
Last updated: 29 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

ARcare, a provider of primary care and behavioral health services in Arkansas, Kentucky and Mississippi, reported to the U.S. Department of Health and Human Services that a malware attack affected the health information of 345,353 patients. News coverage of its notice says an attacker had access to its systems between January 18 and February 24, 2022. ARcare began notifying people and regulators on April 25, 2022.

Sources checked: ocrportal.hhs.gov, nwaonline.com, portswigger.net

Last verified against the official page: 29 Oct 2026

How we research this Report an error

What was exposed

HHS lists names, addresses, dates of birth, Social Security numbers, diagnoses, prescribed medications and other treatment information. Press reports of the notice add that some people's driver's license or state ID numbers, financial account details and health insurance data were also involved. What was exposed varied from patient to patient.

Social Security numbers and dates of birth are what thieves use to apply for credit in someone else's name. Diagnoses and prescriptions are sensitive in themselves and can be used to write messages that look like they come from your provider.

The provider's response

ARcare notified HHS, patients and the media, and posted substitute notice. It offered complimentary credit monitoring and put in place additional administrative and technical safeguards. It said it wasn't aware of any actual or attempted misuse of the information.

What to do if you were in it

1

Read the notice letter

If you were affected you should get a letter from the organization. It says which of your details were involved and whether it offers free credit monitoring. The FTC recommends taking that offer.
2

Freeze your credit

Because Social Security numbers were involved, place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how. Check your reports at annualcreditreport.com.
3

Read your health insurance statements

Look at explanation of benefits statements for treatment or claims you don't recognize, and tell your insurer if something is wrong.
4

Treat messages about the breach as suspect

Expect calls, texts and emails that use real details. Don't click links or give details to someone who contacts you first; contact the organization using a number from its own website.
5

Report misuse

If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
6

Check whether your email or phone is in this and other breaches

Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.

Official filings

U.S. Department of Health and Human Services , filed 25 Apr 2022 : 345,353 people

Timeline

18 Jan 2022
The breach happened
25 Apr 2022
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the ARcare data breach?

The organization sent letters to the people whose details were involved. If you were a patient and got no letter, contact it directly using the contact details on its own website.

What was exposed?

Names, addresses, dates of birth, Social Security numbers, diagnoses, medications and other treatment information, according to HHS. Press reports of the notice add driver's license or state ID numbers, financial account details and health insurance data for some people.

Should I freeze my credit?

If your Social Security number was exposed, a freeze is a sensible step. It's free, you set it up at each of the three bureaus, and you can lift it when you need to apply for credit.