American Addiction Centers data breach: information taken from its Salesforce environment, 327,754 people

What happened in the American Addiction Centers breach?

AAC says it learned of suspicious activity in its Salesforce environment on June 5, 2026, and determined on June 8 that a third party had taken information from it on May 12. The letter describes this as an incident that came through a third-party vendor, and says it did not involve access to AAC's systems, network or health records application.

Date	What the letter and the regulators' records say
May 12, 2026	Information taken from AAC's Salesforce instance; breach date on California's record and Washington's list
June 5, 2026	AAC learns of suspicious activity
June 8, 2026	AAC determines that information was taken
August 7, 2026	Report submitted to HHS; notice recorded by California and Washington; report logged in Massachusetts

63 days passed between AAC learning of the activity and the regulator records.

What information was involved?

Names, contact information, Social Security numbers and a brief description each person gave of their health. AAC says the information did not come from its electronic health records application; it was limited to what people shared during an initial outreach to AAC. Washington lists names, Social Security numbers, health insurance policy or ID numbers and medical information.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	327,754
Washington attorney general	Washingtonians	1,155
Massachusetts consumer affairs office	Massachusetts residents	1

What is AAC offering people who got a letter?

A complimentary membership in Epiq's Privacy Solutions ID; the number of months is a blank field in the filed copy.

Item	Detail from the letter
Provider	Epiq (Privacy Solutions ID)
Enrollment	www.privacysolutionsid.com, with the activation code and deadline on the letter
Phone	1-888-650-3763, Monday to Friday, 9:00 a.m. to 9:00 p.m. Eastern Time

AAC says it has added safeguards to protect and monitor its Salesforce environment. The vendor and cloud tenant guide compares other breaches that came through hosted business applications.

Why does this breach matter to the people affected?

The information came from people's initial outreach to AAC, so it can show that a person contacted AAC, with a description of their health, even if they never became a patient. The letter recommends checking statements from health insurers and providers for services that were not received.

What the documents leave open

• Which third-party vendor was involved and how the Salesforce instance was reached.
• Whether the data has been published.