American Addiction Centers (“AAC”) has notified affected individuals of a security incident involving a third-party vendor platform. The company has stated that certain personal information, including Social Security numbers, may have been compromised.
American Addiction Centers’s Data Breach Investigation
According to a notification letter filed with the California Attorney General’s office, AAC first learned of suspicious activity in its Salesforce environment on June 5, 2026. The company says it immediately activated its incident response protocols, took steps to contain the activity, and began an investigation. By June 8, 2026, AAC determined that an unauthorized third party had acquired certain information from its Salesforce instance, with the actual access dated to May 12, 2026. AAC has stated that this incident did not involve its core systems, network, or electronic health records application, but was instead limited to information gathered during an initial client outreach process stored in Salesforce.
The compromised information reportedly included the affected individual’s name, contact information, Social Security number, and a brief description of their health that they had provided during initial outreach to AAC. Because AAC operates addiction treatment centers, any exposure of health-related information carries an added layer of sensitivity beyond a typical data breach, given the private and often stigmatized nature of substance use treatment.
Third-party vendor breaches, like the one AAC has described involving its Salesforce environment, are an increasingly common attack vector. Rather than targeting a company’s core network directly, attackers often go after the cloud platforms and vendor systems that store copies of sensitive customer data, since those systems can sometimes have different security configurations than a company’s primary infrastructure. When a breach occurs through a vendor platform, the responsibility for notifying affected individuals and offering remediation still falls on the company whose customers’ data was exposed.
Individuals whose Social Security numbers and health information are exposed in a breach like this face an elevated risk of identity theft and medical identity theft. A stolen Social Security number can be used to open new credit accounts, file fraudulent tax returns, or apply for government benefits in a victim’s name, while exposed health information tied to addiction treatment could potentially be misused for targeted scams or embarrassment given the sensitive subject matter.
When Did This Breach Occur?
AAC has stated that an unauthorized third party acquired information from its Salesforce instance on May 12, 2026. The company detected suspicious activity on June 5, 2026, and confirmed the unauthorized access on June 8, 2026.
What Information Was Breached?
According to AAC’s notification letter, the exposed information included each affected individual’s name, contact information, Social Security number, and a brief description of health information they had previously provided to AAC during an initial outreach.
What You Can Do
AAC is offering a complimentary identity monitoring membership to affected individuals. In addition, consider taking these steps:
- Enroll in any complimentary credit or identity monitoring service offered by AAC
- Regularly review statements from your health insurer and healthcare providers for unfamiliar charges
- Consider placing a fraud alert or credit freeze with the three major credit bureaus
- Watch for phishing attempts referencing this incident or American Addiction Centers
File a Data Breach Lawsuit Against American Addiction Centers
If you were affected by the American Addiction Centers data breach, you may have legal options available to you. Companies that collect and store sensitive personal and health information have a responsibility to implement reasonable safeguards to protect it, and a class action lawsuit can help hold a company accountable when that responsibility isn’t met.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
