HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedFinancial accountIdentity (basic)Government IDPHIHealth (basic)HighContained

American Addiction Centers, Inc.

bd_3555da6094fb98d8 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 5, 2026

Filed

Aug 7, 2026

To disclose

9 weeks

Affected

1,155state residents only

Linked

6 filings

Confidence

71%

Full breach record for American Addiction Centers, Inc. →5 incidents on file

American Addiction Centers (AAC) disclosed a breach involving unauthorized access to its Salesforce environment. An unauthorized third party accessed data from May 12, 2026, to June 5, 2026, when suspicious activity was detected. Approximately 1,155 Washington residents were affected, with data including names, contact info, and for a small subset, SSNs and health insurance details. AAC notified individuals on August 7, 2026, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d9 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 24 days

discovery → filing · 9 weeks / 63 days

May 12, 2026

Begins

Jun 5, 2026

Discovered

Aug 7, 2026

Filed

vs. sector median

on median

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_5042b16d43008ce42026-08-07Verified
HHS OCRbd_96fc6e5e60ee8b752026-08-07Verified
Massachusetts State AGbd_e5a08370b5e33e782026-08-07Verified
California State AGbd_e643d160bcc6be832026-08-07Verified

Show 1 more filing ↓up to 6d gap

Illinois State AGbd_57bc2a3fe531681e2026-08-01 · +6dVerified

Name: American Addiction Centers, Inc.
norm: american addiction centers
Domain: americanaddictioncenters.org

Name: American Addiction Centers, Inc.
norm: american addiction centers
Domain: americanaddictioncenters.org
Industry: Healthcarellm

Discovered: Jun 5, 2026
Breach occurred: May 12, 2026
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 7, 2026
Affected individuals: 1,155state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberHealth insurance IDMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 0d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Implemented its incident response protocols
Took measures to contain the activity
Initiated an investigation
Began mailing notification letters to affected individuals via USPS First-Class mail
Established a dedicated, toll-free call center
Changes made: Implemented, and will continue to adopt, additional safeguards to protect and monitor our Salesforce environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGAug 1 · first

New Hampshire State AG+6d

HHS OCR+6d

Massachusetts State AG+6d

California State AG+6d

Washington State AG+6d · this page

Pattern: first filing Aug 1 (IL), last Aug 7 (WA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA42250.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 7, 2026
Raw hash: 2edefe2e6c211fdda5a63fd17f91c004bbc3f6ecc5c65958add0187ad63ec2c1

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAmerican Addiction Centers, Inc.

Victim entityAmerican Addiction Centers, Inc.

Incidentdiscovered Jun 5, 2026

Stated responseImplemented its incident response protocols

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com