Almeida Law Group is investigating a data breach at American Addiction Centers. The breach occurred on May 12th, 2026. If you were affected, contact Almeida Law Group.
About American Addiction Centers
American Addiction Centers (AAC) is a for-profit addiction treatment provider founded in 2004 and headquartered in Brentwood, Tennessee. It operates inpatient and outpatient substance abuse treatment facilities across multiple states, including California, Florida, Massachusetts, Mississippi, Nevada, New Jersey, Rhode Island, and Texas. Affiliated treatment centers include AdCare, the Greenhouse, Desert Hope Center, Oxford Treatment Center, Recovery First, Sunrise House, River Oaks Treatment Center, and Laguna Treatment Hospital. Because AAC collects sensitive personal and health-related information from people seeking treatment, breaches affecting its systems carry significant risks for those individuals.
What Happened?
American Addiction Centers was listed in a California Attorney General sample breach notice filed on August 7th, 2026. According to that notice, AAC learned of suspicious activity in its Salesforce environment on June 5th, 2026. By June 8th, 2026, AAC determined that an unauthorized third party had acquired certain information from its Salesforce instance on May 12th, 2026. AAC states the incident occurred through a third-party vendor and did not involve access to AAC’s own systems, network, or health records application. The compromised information was limited to data collected during initial outreach to AAC and included names, contact information, Social Security numbers, and a brief health description provided by the affected individual. AAC is offering complimentary identity protection through Epiq Privacy Solutions ID to those affected.
This is a separate and distinct incident from AAC’s previously reported 2024 data breach. In September 2024, AAC suffered a breach affecting 422,424 individuals. The Rhysida ransomware group claimed responsibility on November 16th, 2024, and alleged it stole approximately 2.8 terabytes of data, which was subsequently leaked publicly. AAC’s own notification letters did not confirm a ransomware attack. That prior incident led to twelve consolidated class action lawsuits and a $2.75 million settlement (Case No. 3:24-cv-01505, U.S. District Court, Middle District of Tennessee), which received preliminary court approval on December 5th, 2025, with a final approval hearing scheduled for April 20th, 2026. The May 2026 Salesforce breach occurred while that prior litigation was still being resolved. No litigation specific to this May 2026 incident has been reported as of the date of this post.
Key Facts at a Glance
- Company or Organization: American Addiction Centers
- Industry: Healthcare – Substance Abuse Treatment / Behavioral Health
- Location: Brentwood, Tennessee (headquarters); treatment centers across eight states
- Incident type: Unauthorized third-party access to Salesforce environment via a third-party vendor
- Date of breach: May 12th, 2026
- Date breach discovered: June 5th, 2026
- Date of consumer notification: August 7th, 2026
- Identity theft protection offered: Yes – Epiq Privacy Solutions ID (1-Bureau Credit Monitoring, Dark Web Monitoring, Credit Freeze Assistance, Change of Address Monitoring, Identity Restoration Assistance)
- Prior breach: Yes – September 2024 breach affecting 422,424 individuals; Rhysida ransomware group claimed responsibility; $2.75M class action settlement reached
- Litigation status: No litigation reported specific to the May 2026 incident; prior 2024 breach resulted in consolidated class action and $2.75M settlement (Case No. 3:24-cv-01505)
- Source: California Attorney General sample breach notice (https://oag.ca.gov/ecrime/databreach/reports/sb24-627976); supplemental sources: https://www.hipaajournal.com/american-addiction-centers-ransomware-attack/, https://therecord.media/data-breach-american-addiction-centers, https://www.paubox.com/blog/american-addiction-centers-reaches-2.75m-settlement-for-ransomware-breach, https://www.classaction.org/news/2.75m-american-addiction-centers-settlement-resolves-class-action-lawsuit-over-2024-data-breach
What Should You Do?
If you received a notice from American Addiction Centers about this breach, enroll in the complimentary Epiq Privacy Solutions ID identity protection service before the enrollment deadline listed in your notice by visiting www.privacysolutionsid.com. Beyond that, consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent new accounts from being opened in your name. Monitor your existing financial accounts and check your credit reports for free at AnnualCreditReport.com. Because a brief health description was included in the exposed data, also review any Explanation of Benefits statements from your health insurer and watch your medical records for services you did not receive. If you suspect your information is being misused, visit IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
