American Addiction Centers Waited Nearly Three Months to Disclose a Breach That Exposed Names, Social Security Numbers, and Private Health Details
American Addiction Centers (AAC) has notified individuals that someone outside the company accessed personal information stored in AAC’s Salesforce system. Salesforce is a customer relationship management platform, meaning it stores information about people who contact a company, not necessarily people who are already enrolled as patients.
According to AAC’s notice, an unauthorized third party acquired information from AAC’s Salesforce instance on May 12, 2026. AAC says it learned of suspicious activity in that environment on June 5, 2026, and confirmed on June 8, 2026 that the third party had taken data. AAC did not report the incident to state attorneys general, including California’s, until August 7, 2026, nearly three months after the data was actually taken.
AAC says the incident did not involve its electronic health records system, network, or broader systems. The exposed information was limited to what AAC collected during an initial outreach, meaning the first time someone contacted AAC, often to ask about treatment.
Almost three months passed between when AAC says the data was taken and when it told state regulators. AAC has not explained why it took that long to notify the people affected. During that window, anyone whose Social Security number and health information were exposed had no way to protect themselves.
The exposed information includes a description of a person’s health that they gave AAC directly, in the context of reaching out about addiction treatment. Combined with a name, contact information, and Social Security number, that combination can be used for identity theft. It also carries a separate privacy risk: addiction treatment is the kind of health information that can carry stigma and real consequences if it becomes public.
AAC is offering a complimentary membership in Privacy Solutions ID through Epiq. The notice does not specify how many months of coverage are included. The service includes 1-bureau credit monitoring with alerts, dark web monitoring of one email address, phone number, name, date of birth, and Social Security number, assistance with 3-bureau credit freezes, monitoring for unauthorized address changes, and identity restoration assistance. AAC’s enrollment support line is 866.675.2006, and AAC’s general contact line is 1-888-650-3763.
A Social Security number paired with a name and contact information is enough for someone to attempt identity theft, including opening new credit accounts or filing fraudulent tax returns. Because the exposed data also includes a personal health description tied to addiction treatment, there is an added risk beyond ordinary identity theft: that information could be used to embarrass, harass, or extort someone.
Companies that collect sensitive personal and health information have a legal duty to protect it and to notify affected individuals without unreasonable delay. If AAC’s nearly three-month gap between the breach and notification caused you harm, or if your Social Security number or health information was exposed, you may have legal options.
Contact Emery | Reddy, PC today for a Free Case Review. There is no fee unless we recover for you.
What happened in the American Addiction Centers data breach?
AAC says an unauthorized third party accessed its Salesforce customer relationship management system and took data on May 12, 2026. AAC discovered the suspicious activity on June 5, 2026, and confirmed the data theft on June 8, 2026.
What information was exposed?
Names, contact information, Social Security numbers, and a brief health description that individuals provided to AAC, typically when first reaching out about treatment.
How many people were affected?
AAC has not disclosed a nationwide or California-specific total. In its notice to Washington’s attorney general, AAC reported 1,155 Washington residents affected. That figure does not include California.
Why did it take so long for AAC to notify people?
AAC has not publicly explained the gap. Data was taken May 12, 2026, and AAC did not notify state attorneys general until August 7, 2026, nearly three months later.
Do I have a legal claim?
If you contacted American Addiction Centers and your name, Social Security number, or health information was exposed in this breach, you may have a legal claim. Contact Emery | Reddy, PC today for a Free Case Review. There is no fee unless we recover for you.
Whether you’ve been injured on the job, subjected to mistreatment in the workplace, or affected by a privacy breach, our expert attorneys are here to help.
