On September 26, 2024, American Addiction Centers appeared on the leak site operated by the rhysida ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the nationwide network of addiction-treatment facilities. The company has not yet published a formal breach notification detailing the exact number of individuals affected or the full scope of data involved.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch American Addiction Centers
Get alerted the next time American Addiction Centers files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about American Addiction Centers’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details in the Leak-Site Listing
The rhysida leak site, mirrored on ransomware.live, lists American Addiction Centers as a victim and claims that sensitive internal files were stolen. The disclosure indicates that the data was taken after the company apparently declined to meet the group's ransom demand. No specific volume of records or list of exact data types is provided in the posting itself. The incident is dated to an intrusion that occurred prior to the September 26 public listing, consistent with the group's typical timeline of publishing samples after an initial extortion window closes.
Why This Matters for You and Your Family
If you or a family member has ever sought treatment at an American Addiction Centers facility in California, Florida, Texas, Nevada, Massachusetts, Mississippi, New Jersey, or Rhode Island, your personal information may now sit in an attacker-controlled archive. Internal files from addiction-treatment providers routinely contain names, dates of birth, Social Security numbers, contact details, insurance information, medical histories, and treatment notes. Exposure of this combination creates immediate risks of identity theft, insurance fraud, and targeted scams that exploit the sensitive nature of substance-abuse records. Even when exact record counts remain unknown, the potential reach is large given the company's position as one of the largest networks of rehab facilities in the United States.
Doxxing and Identity-Chain Risks
Stolen internal files rarely stay isolated. Attackers and subsequent buyers can cross-reference names and addresses with other breaches to build detailed profiles. A phone number tied to a treatment record can link to social-media accounts, children's school information, or family-member profiles. These chains often surface on dark-web marketplaces and extortion forums. Credential leaks that commonly accompany ransomware incidents can also cascade into gaming-account takeovers, especially for households where teenagers use the same email addresses or passwords. Once an attacker controls a gaming account tied to a real identity, further doxxing becomes trivial.