Arrowhead Evaluation Services, Inc. (AES), a California-based provider of independent medical evaluation services, experienced a data breach that exposed sensitive personal and medical information.
The cybersecurity incident, which took place on June 14, 2024, was discovered on May 2, 2025. It was then disclosed to the California Attorney General’s office and a Notice of Data Security Incident was posted on the Arrowhead Evaluation Services website on June 2, 2025.
Information compromised includes full names, dates of birth, Social Security numbers, driver’s license numbers, alien registration numbers, financial account information, insurance information, medical policy numbers, diagnosis and treatment details, and physician information.
After the breach was discovered, Arrowhead Evaluation Services, Inc. notified the California Attorney General's office and posted a notice on its own website. Impacted individuals were notified by mail on June 2, 2025.
Arrowhead has set up a helpline at 1-800-939-4170, available Monday through Friday, 9:00 am to 9:00 pm Eastern Time.
For more information about the company, visit the Arrowhead Evaluation Services website.
A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.
This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.