Saber Healthcare Group data breach: what the notice says, and why Indiana counts 427,084

What happened at Saber Healthcare?

Saber says it secured its network and brought in outside forensic experts, who confirmed that some information may have been accessed by an unauthorized individual. It finished reviewing the affected information on August 19, 2026 and began looking up addresses to notify people. HHS lists the report as a hacking or IT incident involving a laptop and a network server, filed by Saber as a business associate.

Date	What the notice and the regulators' records say
May 29, 2026	Breach date on Indiana's record
July 27, 2026	Saber becomes aware of unauthorized activity
August 19, 2026	Review of the affected information finished
September 25, 2026	Notice posted; report to HHS (282,727); Indiana notice date (427,084)
September 26, 2026	Logged in Massachusetts (422)
September 29, 2026	Posted by Texas (269)

Indiana's record dates the breach from May 29, 2026, almost two months before Saber says it became aware. The notice does not say when the activity began.

What information was involved?

The notice says the information varies by person and may include a name with one or more of: date of birth, driver's license or state ID number, health insurance information, medical information, financial account information, passport number and Social Security number.

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Total affected	427,084
HHS Office for Civil Rights	Individuals affected	282,727
Indiana attorney general	Indiana residents	7,672
Massachusetts consumer affairs office	Massachusetts residents	422
Texas attorney general	Texans	269

Indiana's total is 144,357 higher than HHS's. Neither record explains the difference.

Why did I get a Saber letter about a family member who has died?

Because Saber wrote to the next of kin of people whose records were in the files, and its letter has a section on protecting a deceased family member's information. The letter filed with South Carolina's consumer affairs department, dated September 25, 2026, is addressed "To the Next of Kin of" the person and says information related to "your loved one" was in the files that may have been accessed. It lists the loved one's name with their Social Security number, driver's license or state ID, the bank account number used for billing, medical records, treatment information and health insurance information.

The letter also says the review of the files was still going on when it was sent, so more letters may follow.

What it suggests for a relative's records:

Step	What the letter says
Watch statements	Review the loved one's account statements and explanation-of-benefits forms for errors
Get the credit report	An executor or surviving spouse can ask any of the three credit bureaus for the deceased person's credit report
Questions	1-833-918-1128, Monday to Friday, 9:00 am to 9:00 pm Eastern Time, with the engagement number on the letter

What should I do about the Saber Healthcare breach?

Saber's website notice does not mention credit monitoring, but the letter it filed in South Carolina does: it offers free credit monitoring and identity protection services, and says Saber reset passwords and reviewed its policies and procedures. The enrolment details are on each letter. It encourages patients to watch account statements and explanation-of-benefits forms, and to consider a fraud alert.

Item	Detail from the notice
Hotline	1-833-918-1128
Email	cyber-incident@saberhealth.com
Postal address	23700 Commerce Park, Beachwood, OH 44122

What the documents leave open

• How the intruder got in, and what the laptop on the HHS record had to do with it.
• Which Saber facilities' patients are affected, and how many letters went to next of kin rather than to the person named.
• Why the Indiana and HHS totals differ.