American Addiction Centers Listed by rhysida Ransomware Group

On September 26, 2024, American Addiction Centers appeared on the leak site operated by the rhysida ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the nationwide network of addiction-treatment facilities. The company has not yet published a formal breach notification detailing the exact number of individuals affected or the full scope of data involved.

Details in the Leak-Site Listing

The rhysida leak site, mirrored on ransomware.live, lists American Addiction Centers as a victim and claims that sensitive internal files were stolen. The disclosure indicates that the data was taken after the company apparently declined to meet the group's ransom demand. No specific volume of records or list of exact data types is provided in the posting itself. The incident is dated to an intrusion that occurred prior to the September 26 public listing, consistent with the group's typical timeline of publishing samples after an initial extortion window closes.

Why This Matters for You and Your Family

If you or a family member has ever sought treatment at an American Addiction Centers facility in California, Florida, Texas, Nevada, Massachusetts, Mississippi, New Jersey, or Rhode Island, your personal information may now sit in an attacker-controlled archive. Internal files from addiction-treatment providers routinely contain names, dates of birth, Social Security numbers, contact details, insurance information, medical histories, and treatment notes. Exposure of this combination creates immediate risks of identity theft, insurance fraud, and targeted scams that exploit the sensitive nature of substance-abuse records. Even when exact record counts remain unknown, the potential reach is large given the company's position as one of the largest networks of rehab facilities in the United States.

Doxxing and Identity-Chain Risks

Stolen internal files rarely stay isolated. Attackers and subsequent buyers can cross-reference names and addresses with other breaches to build detailed profiles. A phone number tied to a treatment record can link to social-media accounts, children's school information, or family-member profiles. These chains often surface on dark-web marketplaces and extortion forums. Credential leaks that commonly accompany ransomware incidents can also cascade into gaming-account takeovers, especially for households where teenagers use the same email addresses or passwords. Once an attacker controls a gaming account tied to a real identity, further doxxing becomes trivial.

Rhysida's Known Track Record

Public reporting attributes the first appearance of Rhysida to mid-2023. The group has since claimed responsibility for attacks on healthcare providers, educational institutions, and municipal governments. Notable prior victims include hospitals and universities where patient or student records were allegedly exfiltrated. Their standard playbook involves gaining initial access, often through compromised remote-desktop credentials or unpatched vulnerabilities, followed by exfiltration of internal documents before deploying ransomware. When payment is refused, Rhysida publishes a sample of stolen data on their leak site and threatens full release. The group typically sets short deadlines for payment and follows through on publication when those deadlines pass.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the American Addiction Centers records.
• Rotate any password you ever used at an American Addiction Centers patient portal or related service, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is flagged within hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children's gaming accounts that often share the same contact details used in medical records.
• Let remediation specialists handle ongoing takedown requests for any exposed personal documents that surface on data-broker or extortion sites.

The incident underscores how quickly treatment-center records can move from protected health information to publicly tradable extortion material. One short forward-looking step can limit the damage: start mapping and locking down your identity chains now. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children's gaming accounts vulnerable to credential-stuffing attacks that often follow leaks like this one.