American Addiction Centers 2024 Data Breach
ObscureIQ Breach Intelligence
High SeverityWebsite / service breach
American Addiction Centers Behavioral Health Network Breach (2024): 422K Patient Records Including Medical Diagnosis & SSN Exposed via Ransomware
Addiction treatment provider operating rehab and recovery programs.
Verified by ObscureIQ Intelligence
87/100Breach Risk Index
60Data Value
40Market Recency
294dSince Breach
Breach Intelligence Summary
Entity: American Addiction Centers · Actor: Rhysida · Sources: 2 references
Attack: Ransomware / Extortion
Profile: Healthcare provider · Addiction treatment and rehabilitation · Behavioral health network · USA
Timeline: Breach (2024-09-23) · Indexed (Sep 17, 2025) · Year (2024)
Exposure: 422K records · 9 fields: Date of Birth, Email Address, Full Name, Health Insurance, Medical Diagnosis, Medical Record Number, Phone Number, Physical Address, Social Security Number
Status: Confirmed
Executive Summary
In September 2024, American Addiction Centers suffered a ransomware attack attributed to the Rhysida group, detected around September 26, 2024. Rhysida claimed to have exfiltrated approximately 2.8 terabytes of data and published it online after the incident. AAC notified 422,424 individuals on December 23, 2024. Exposed data included names, Social Security numbers, dates of birth, addresses, phone numbers, medical record numbers, treatment/medical information, and health insurance information. The breach is catalogued by DataBreach.com (whose parse cited 528,343 records) and reported to state regulators; AAC offered credit monitoring and later reached a class-action settlement.
ObscureIQ assessment: Extremely sensitive. Exposure creates identity theft and medical fraud risk, but the greater danger is reputational harm, extortion, stigma-based targeting, and manipulation tied to addiction treatment history.
Breach Impact
The breach exposed identity, contact, and clinical data, including Social Security numbers and addiction-treatment information, for more than 422,000 patients, a population for whom disclosure of treatment status carries severe stigma. Beyond identity-theft and medical-fraud risk, the exposure created acute potential for extortion and discrimination, eroded patient trust in a highly sensitive care setting, and generated significant legal and regulatory consequences.
About American Addiction Centers
American Addiction Centers (AAC) is a Tennessee-based national provider of substance-use and behavioral-health treatment, operating a network of inpatient and outpatient rehabilitation facilities across the United States. It delivers detox, residential, and outpatient addiction treatment along with mental-health services, maintaining detailed clinical, insurance, and billing records for patients in recovery.
Why They Hold Your Data
Addiction treatment networks collect highly sensitive patient data, including identity records, SSNs, home addresses, insurance information, medical record details, and treatment-related health data.
Recent Developments
AAC continues to operate its national treatment network. After the September 2024 ransomware attack it notified 422,424 individuals, offered credit monitoring, and faced multiple class-action lawsuits, which it resolved through a reported $2.75 million settlement. The incident drew particular scrutiny because substance-use treatment records carry heightened federal protection under 42 CFR Part 2.
Data Points Exposed
9 verified field types
Date of Birth High
Email Address
Full Name High
Health Insurance
Medical Diagnosis Critical
Medical Record Number
Phone Number
Physical Address High
Social Security Number Critical
Field names are shown in full for clarity and search visibility. Canonical machine keys are emitted only in this page’s structured data.
Exploitation & Downstream Threats
Threat Activity:Critical
Primary downstream threats:
- Extortion and stigma-based targeting exploiting addiction-treatment status
- Medical identity fraud and insurance abuse using health and insurance data
- Identity theft and synthetic identity construction using SSN and DOB
- Targeted phishing and vishing using name, email, and phone
- Doxxing and physical targeting from exposed home addresses
- Discrimination risk from disclosure of substance-use treatment
Threat vectors:
- Medical extortion, insurance fraud & discrimination
- Stigma-based targeting & coercion
- Full identity theft & synthetic identity fraud
- Name-based social engineering
- SIM swapping, vishing & SMS phishing
- Physical stalking, mail fraud & identity verification
- Home targeting, stalking & physical threat
Threat Actor: Rhysida
Rhysida
Ransomware / Extortion
Attribution and method are based on available breach intelligence. Reported attack vector: Ransomware / Extortion.
Recommended Actions
If you believe your information may be included:
Protect Your ID Documents
Government-ID exposure enables document fraud — monitor and report misuse.
Enable MFA Everywhere
Turn on multi-factor authentication on email first, then financial accounts.
Report & Recover
If you spot misuse, start an official recovery plan and report fraud.
Frequently Asked Questions
What happened in the American Addiction Centers breach?▾
In September 2024, American Addiction Centers suffered a ransomware attack attributed to the Rhysida group, detected around September 26, 2024. Rhysida claimed to have exfiltrated approximately 2.8 terabytes of data and published it online after the incident. AAC notified 422,424 individuals on…
What data was exposed?▾
Verified fields include Date of Birth, Email Address, Full Name, Health Insurance, Medical Diagnosis, Medical Record Number, Phone Number, Physical Address, Social Security Number.
What should I do if I was affected?▾
Change reused passwords, enable MFA, and (if identity or financial data is involved) freeze your credit and monitor your accounts.
Sources & References
Every claim on this page is traceable. This breach draws on:
Breach Index
ObscureIQ Intelligence
ObscureIQ proprietary analysis
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation