American Addiction Centers Data Breach

The company learned of a cybersecurity incident around September 26, engaged outside experts, and notified law enforcement. By October 3, the investigation had determined that an unauthorized party took certain data from its systems between September 23 and 26.

American Addiction Centers did not disclose the initial access method or an exploited vulnerability. The Rhysida ransomware group claimed responsibility, but the company notice did not confirm the actor's identity. The event is therefore recorded as confirmed unauthorized access and data acquisition, while the actor attribution remains unverified.

The individual notice listed names, addresses, phone numbers, dates of birth, medical record numbers or other identifiers, Social security numbers, and health insurance information. The combination of fields varied by person.

The initial notice said treatment information and payment-card data were not involved. A later court-authorized settlement notice included treatment information within its definition of the private information at issue. Recipients should rely on the categories listed in their own notice.

An initial report to the U.S. Department of Health and Human Services listed 410,747 patients. The company's later December 23, 2024 filing with the Maine Attorney General reported 422,424 people. These are not separate incidents or totals to add together; the catalog uses the later reported total for the same event.

Social security numbers combined with dates of birth and addresses can support identity theft or fraudulent account applications. Health-insurance information and medical identifiers can also be used for fraudulent claims, medical identity misuse, and convincing person-specific scams.

Health information connected with addiction treatment presents an additional and serious privacy risk. Threatening or extortionate messages that refer to such information should not be answered, and incident support should be reached only through independently verified organization channels.

The organization said it contained the attack, worked with law enforcement and external cybersecurity specialists, and implemented additional safeguards. Affected people were offered 12 months of single-bureau credit monitoring, a credit report, a credit score, and proactive fraud assistance.

Notice recipients can activate the complimentary monitoring service through the verified instructions in their letter, review credit reports, and consider a credit freeze or fraud alert. Unrecognized financial activity should be reported directly to the relevant institution.

Health-insurance explanations, patient portals, and medical bills should be checked for services that were not received. Unexpected links claiming to come from American Addiction Centers, an affiliated treatment center, or the monitoring provider should be avoided until the sender is verified through an independent contact channel.