Social EngineeringPhishingCustomer Data InvolvedTargetedIDENTITY_BASICHEALTH_BASICLowContained
ACADIA HEALTHCARE COMPANY, INC.
bd_63ceafab8c51b441 · schema v1 · pii pii-v1
Full breach record for ACADIA HEALTHCARE COMPANY, INC. →Acadia Healthcare Company, Inc. disclosed a data security incident involving unauthorized access to a single email and SharePoint account via social engineering/phishing between March 21 and March 25, 2026. The incident exposed patient names, admission dates, diagnosis codes, and patient status. The company secured the accounts, engaged forensic investigators, and is providing cybersecurity training. No EHR systems were affected.
Massachusetts clock⏱ MA AG >30d5 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-840-acadia-healthcare-company-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 1, 2026
- Raw hash
- 6f6b41a5fe05666c8042b58c200376f17a3474d93d182b466ef3eb20eb251371
Reporting entity
- Name
- ACADIA HEALTHCARE COMPANY, INC.norm: acadia healthcare
Victim entity
- Name
- ACADIA HEALTHCARE COMPANY, INC.norm: acadia healthcare
Incident
- Discovered
- Mar 25, 2026
- Materiality determined
- —
- Notification sent
- May 22, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICHEALTH_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 5 weeks(37 days from discovery to filing)
- Compliance flags
- MA AG >30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.