American Addiction Centers Breach Exposes Patient Health Data
American Addiction Centers reported a data security incident in Oregon that compromised sensitive patient health and personal information. If you received a notification letter, your data could be exposed to risks like medical fraud and identity theft. Understanding your legal standing can help you decide on next steps after this breach.
Received a American Addiction Centers notification letter? Find out in minutes if you qualify for compensation.
Free case review- State
- Oregon
- Breach date
- June 5, 2026
- Reported
- September 3, 2026
What may have been exposed
- Full Name
- Date of Birth
- Social Security Number
- Medical Record Number
- Health Insurance ID Number
- Diagnosis and Treatment Information
- Prescription Information
- Provider and Treatment Dates
- Billing and Financial Information
American Addiction Centers, a prominent provider of substance use disorder treatment, reported a data breach on September 3, 2026, to the Oregon Attorney General. This incident involved the compromise of highly confidential patient data, raising concerns about the security of information entrusted to healthcare providers. As a major custodian of sensitive health records, the organization is expected to maintain robust digital and physical safeguards.
The breach exposed several categories of private information. These include your Full Name, Date of Birth, Social Security Number, Medical Record Number, Health Insurance ID Number, Diagnosis and Treatment Information, Prescription Information, Provider and Treatment Dates, and Billing and Financial Information. This combination of identifying and deeply personal health details is particularly valuable to malicious actors.
For individuals affected, the exposure of behavioral and medical treatment data carries significant risks. Beyond the immediate threat of identity theft or financial fraud, compromised health information can lead to targeted medical fraud, where criminals use your details to obtain unauthorized prescriptions or services. There is also a severe risk of social stigma and reputational damage due to the sensitive nature of addiction treatment records.
Healthcare providers like American Addiction Centers are legally bound by federal laws such as HIPAA and HITECH, as well as Oregon's specific data privacy statutes. These laws mandate rigorous security measures, including strong administrative safeguards and continuous network monitoring, to protect electronic health information. A breach of this magnitude suggests that these crucial legal obligations may not have been fully met.
Receiving a data breach notification letter from American Addiction Centers indicates that your private information was likely exposed. This provides you with legal standing to address potential negligence. You are not required to demonstrate immediate financial loss to explore your legal options. Our firm offers a free case review to help you understand your rights and potential remedies, with no out-of-pocket costs unless we secure compensation for you.
What to do if you were affected
Based on the categories of information reported in this filing, these steps can help limit the risk of identity theft and fraud.
Freeze your credit
Place a free credit freeze with Equifax, Experian, and TransUnion. A freeze blocks new accounts from being opened in your name and can be lifted anytime.
Watch your financial accounts
Review bank and card statements for unfamiliar activity and turn on transaction alerts. Report anything you don't recognize to your bank right away.
Check for medical identity theft
Review the Explanation of Benefits statements from your health insurer for services or claims you never received, which can signal misuse of your medical identity.
Stay alert to targeted scams
Be cautious of calls, texts, or emails that reference this breach. Legitimate organizations won't ask you to confirm sensitive details through an unsolicited message.
Keep your notification letter
Save the notice you received. It documents that your information was involved and is often needed to enroll in any credit monitoring offered or to join a related legal claim.
Source: Oregon Attorney General filing
Related data breach cases
- Sheppard, Mullin, Richter & Hampton LLP
- Midvale Indemnity Company
- Poppins Payroll Company
- Lamb Weston Holdings, Inc.
- City of McMinnville
- Upbound Group, Inc.
- OneMain Financial
- MedImpact Healthcare Systems, Inc.
- Call-On-Doc, Inc.
- Ridgeway Pharmacy Ltd
- IDScan.net
- Kaniksu Community Health
- Craneware, Inc.
- See's Candies - Corporate Office