AAC Announces Second Data Breach in Three Years
American Addiction Centers (AAC) has disclosed another data breach affecting its Salesforce environment. This incident occurred on May 12, 2026, and was not detected by AAC until June 5, when it noticed suspicious activity in its Salesforce instance.
The unauthorized third party accessed certain information, including personally identifiable information and health-related details such as names, contact information, Social Security numbers, and brief descriptions of health conditions. However, this data was limited to what individuals had shared during their initial outreach to AAC.
AAC does not currently have evidence that the exposed information has been or will be misused. As a precautionary measure, affected individuals are being offered a complimentary membership to Privacy Solutions ID, an identity protection service provided through Epiq. This includes one-bureau credit monitoring with alerts for key changes such as credit inquiries, new accounts, and public records.
AAC has set up a dedicated call center for questions about the breach and has reported the incident to the California Attorney General on August 7, 2026.