Acadia Healthcare 2026 Security Incident
The 2026 Acadia Healthcare security incident involved unauthorized access through social engineering to one employee email account and its associated SharePoint area from March 21 through March 25, 2026.
Exposed Data Types
3 sensitive7- Personal health data
- Health insurance information
- Subset-only Health Insurance Claim Numbers
- Names
- Physical addresses
- Dates of birth
- Subset-only Social Security numbers
About This Breach
Unusual activity was detected and the account secured on March 25, and notification began on May 22.
The incident affected 1,807 people. Person-varying fields may include names, addresses, birth dates, health or health-insurance information, and Social Security numbers or Health Insurance Claim Numbers for a subset. The electronic health record system was not involved, and no disruption to healthcare delivery or daily operations was reported.
The 1,807 figure is not people carrying every field, behavioral-health patients, emails, files, or misuse. The record does not establish identity, Acadia patient or employee status, a particular diagnosis or treatment, Social Security or HICN ownership, field co-occurrence, account takeover, fraud, or medical identity theft.
Behavioral-health association, health, insurance, Social Security or HICN, birth-date, and address data require the strictest private handling. Only direct notice recipients or people who know a particular sensitive field may have been involved should follow the medical-record, insurance, and identity protections in their own notice.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
