HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Business Associate (HIPAA)Customer Data InvolvedData ExfiltratedPHIIdentity (basic)Government IDHealth (basic)MediumContained

American Addiction Centers, Inc.

bd_5042b16d43008ce4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 5, 2026

Filed

Aug 7, 2026

To disclose

9 weeks

Affected

1state residents only

Linked

6 filings

Confidence

64%

Full breach record for American Addiction Centers, Inc. →5 incidents on file

American Addiction Centers (AAC) notified the NH Attorney General of a security incident involving its Salesforce instance, a third-party business associate. On June 5, 2026, AAC detected suspicious activity and contained it. Investigation revealed an unauthorized third party accessed data on May 12, 2026. The breach affected approximately one New Hampshire resident, exposing name, contact info, SSN, and brief health descriptions. AAC notified the individual on August 7, 2026, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 24 days

discovery → filing · 9 weeks / 63 days

May 12, 2026

Begins

Jun 5, 2026

Discovered

Aug 7, 2026

Filed

vs. sector median

on median

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_3555da6094fb98d82026-08-07Verified
HHS OCRbd_96fc6e5e60ee8b752026-08-07Verified
Massachusetts State AGbd_e5a08370b5e33e782026-08-07Verified
California State AGbd_e643d160bcc6be832026-08-07Verified

Show 1 more filing ↓up to 6d gap

Illinois State AGbd_57bc2a3fe531681e2026-08-01 · +6dVerified

Name: American Addiction Centers, Inc.
norm: american addiction centers
Domain: americanaddictioncenters.org

Name: American Addiction Centers, Inc.
norm: american addiction centers
Domain: americanaddictioncenters.org
Industry: Healthcarellm

Discovered: Jun 5, 2026
Breach occurred: May 12, 2026
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 7, 2026
Affected individuals: 1state-resident count only
Data types: PHIIdentity (basic)Government IDHealth (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: trusted_relationship

During the incident: Implemented its incident response protocols
Took measures to contain the activity
Initiated an investigation
Mailed a notification letter to the affected individual
Offering the individual a complimentary offer of credit monitoring and identity theft protection services
Established a dedicated, toll-free call center to answer any questions individuals may have about the incident
Changes made: Implemented, and will continue to adopt, additional safeguards to protect and monitor its Salesforce environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGAug 1 · first

Washington State AG+6d

HHS OCR+6d

Massachusetts State AG+6d

California State AG+6d

New Hampshire State AG+6d · this page

Pattern: first filing Aug 1 (IL), last Aug 7 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/american-addiction-centers-20260807.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 7, 2026
Raw hash: 476879bbc2ac0ce1e2959418c28fa838522d9abe4dc48282742ed7b031949f13

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAmerican Addiction Centers, Inc.

Victim entityAmerican Addiction Centers, Inc.

Incidentdiscovered Jun 5, 2026

Stated responseImplemented its incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov