American Addiction Centers americanaddictioncenters.org American Addiction Centers data breach: what happened and what to do
An unauthorized person took data from American Addiction Centers' Salesforce environment on May 12, 2026. It included names, contact details, Social Security numbers and health insurance information. The federal breach portal lists 327,754 people affected.
View all 13,115 breaches- Breach date
- 12 May 2026
- Made public
- 7 Aug 2026
- Affected
- 327,754
- Data exposed
- Names, Social security numbers, Health insurance information, Medical information
- Last updated
What happened
American Addiction Centers (AAC), a US operator of addiction treatment facilities, reported that an unauthorized person took information from its Salesforce environment on May 12, 2026. The company spotted suspicious activity on June 5, 2026 and filed notices with state regulators in August 2026, including California's Attorney General on August 7.
What was exposed
The notices say the data included names, contact details, Social Security numbers, health insurance information and brief descriptions of a person's health from initial outreach to AAC. AAC says its electronic health records application and core network weren't affected. The federal health regulator's breach portal lists 327,754 people affected in total.
Why this matters
Contact details and a note that someone contacted an addiction treatment provider are exactly what scammers use for tailored phishing and extortion attempts. A Social Security number with a name is enough to apply for credit in your name.
AAC is offering credit monitoring and identity protection to people it notified. If you got a letter, enroll. A credit freeze adds protection the monitoring doesn't: it blocks new accounts rather than reporting them afterwards.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze is free and stops new credit being opened with your Social Security number. Place it separately at Equifax, Experian and TransUnion, and lift it only when you apply for credit yourself.
- 2
Enroll in the free monitoring if you got a letter
AAC is offering credit monitoring and identity protection to people it notified. Use the enrollment instructions in your notice.
- 3
Expect targeted phishing and threats
Messages that mention treatment, insurance or AAC may be scams. Don't click links or pay anyone. Look up contact details yourself.
- 4
Read your insurance statements
Health insurance information was exposed. Check explanation-of-benefits statements for services you didn't receive and report them to your insurer.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see where your details have shown up, and get alerted if they appear in new breaches.
Frequently asked
Was I affected by the American Addiction Centers breach?
AAC is notifying affected people by mail. If you contacted or were treated at AAC and haven't heard, call the number in the company's notice.
What was exposed?
Names, contact details, Social Security numbers, health insurance information and brief health descriptions, according to the notices. AAC says its health records application wasn't accessed.
Should I change my password?
Passwords weren't listed as exposed. Changing a reused one is still a cheap precaution.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
