Privacy Unpacked

Confirmed breach

Acadia Healthcare Company data breach

USUnited States · Healthcare · Acadia Healthcare Company, Inc.

Acadia Healthcare Company (United States) notified the California Attorney General of a data breach on 13 November 2026.

People affected
Not reportedno count given yet
Reported
13 November 2026Official notice
Breach began
25 March 2026by the notice
Found to notice
233 days (found 25 March 2026, by the company’s letter)

What was exposed

The register’s list does not say what was exposed; the notice it links to (under Sources) usually does.

How it happened

How
Phishing email security incident that resulted in unauthorized access to certain files source

What the letter says

Found
Upon first learning of this incident on March 25, 2026
Began
between March 21, 2026 and March 25, 2026 and on July 13, 2026, an unauthorized party accessed and acquired certain files
Exposed
your name, Social Security number, and one or more of the following: address, date of birth, diagnosis, lab results, medications, treatment information, health insurance information, provider names, dates of service, payment card information, and/or bank account information
Offered
We are offering you a complimentary one-year membership to credit monitoring and identity theft protection through Epiq – Privacy Solutions

Got a letter or email about this breach? Check it is real →

Read the letter (PDF), as filed with the California Attorney General.

Sources 1

Official notices are read by code from the regulator’s own register. More notices to California. · Corrections and changes

Questions about the Acadia Healthcare Company breach

Was Acadia Healthcare Company hacked?

Acadia Healthcare Company (United States) notified the California Attorney General of a data breach on 13 November 2026. How it happened, by the sources: phishing.

What data was exposed in the Acadia Healthcare Company breach?

The notices and reports so far do not say what was exposed. This page is updated when they do.

How do I know if I was affected?

Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. The letter it filed is on this page. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.

Is there a Acadia Healthcare Company data breach settlement?

No settlement open for claims is on record for Acadia Healthcare Company as of 15 November 2026. A settlement usually comes a year or more after a breach, if a court approves one. Every open settlement is listed with its deadline.

Is a letter, email or text about the Acadia Healthcare Company breach real or a scam?

A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to Acadia Healthcare Company’s own site, or check the letter here.

More breaches in United States

  1. EZaccessMDreportedUSUnited States · 14 November 2026 Social Security numbersHealth and medical informationDates of birth+5 –not reported
  2. UberUSUnited States · CA · 14 November 2026 License information 7.9Kdrivers
  3. USA DeBuskUSUnited States · TX · 13 November 2026 Social Security numbersDriver’s license numbersGovernment ID numbers+6 11KTexas residents
  4. NTN Bearing Corporation of AmericaUSUnited States · 13 November 2026 Social Security numbers 1Vermont residents
  5. WalgreenUSUnited States · 20 February 2026 2Washington residents

Every breach in United States →

Data breach settlements open for claims

Not about Acadia Healthcare Company: settlements over other US data breaches that people can still claim money from.

Every open settlement →

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.