American Addiction Centers Reports Data Breach in Oregon

American Addiction Centers, a significant provider of substance use disorder treatment services, filed a data breach notice with the Oregon Attorney General's office on September 3, 2026. This report indicated a security incident that occurred on June 5, 2026, though the specific type of breach was not detailed in the public filing. The investigation into the incident is currently listed as monitoring.

The official filing from American Addiction Centers specified that the exposed information included Full Name, Date of Birth, Social Security Number, Medical Record Number, Health Insurance ID Number, Diagnosis and Treatment Information, Prescription Information, Provider and Treatment Dates, and Billing and Financial Information. The number of individuals affected by this breach was not specified in the public record.

The exposure of such comprehensive medical and personal data carries significant risks. When details like Social Security Numbers and sensitive health information are compromised, individuals face an elevated risk of identity theft, medical fraud, and other financial harms. The nature of addiction and behavioral health records also introduces unique privacy concerns, as unauthorized disclosure could lead to social stigma or discrimination.

Individuals who receive a breach notification from American Addiction Centers are advised to review their credit reports regularly for any suspicious activity. They should also carefully check statements from their health insurance providers for any services or charges they do not recognize, which could indicate medical identity theft. Placing a fraud alert or security freeze on credit files with the three major credit bureaus (Equifax, Experian, and TransUnion) can provide an additional layer of protection against unauthorized use of personal information.

It is also prudent to remain cautious about unexpected communications, such as emails, calls, or texts, that claim to be from American Addiction Centers or other entities requesting personal or financial details. Official communications regarding the breach are typically sent via postal mail. Always verify the authenticity of such requests directly with the organization through official channels before sharing any information.