Noss & Russell, LLP Investigates American Addiction Centers Breach Exposing California Callers' Information
Noss & Russell, LLP is investigating a data breach at American Addiction Centers, the national treatment provider whose California facilities include Laguna Treatment Center in Aliso Viejo. According to the company's notification letters, an unauthorized party took the names, Social Security numbers, and health descriptions of people who had reached out to the company for help with addiction. If you contacted American Addiction Centers and received a notice about this incident, this investigation may concern you.
According to the company's notification letters, American Addiction Centers learned of suspicious activity in its Salesforce environment on June 5, 2026. Three days later, on June 8, it determined that an unauthorized third party had taken information from that system on May 12, 2026 — roughly three and a half weeks before the company noticed.
The letters state that the information involved included each person's name, contact information, Social Security number, and a brief description of their health that they had provided themselves. The company emphasizes that this information did not come from its electronic health records system, and was instead limited to information gathered during a person's initial outreach to the company.
That distinction deserves a closer look rather than acceptance at face value. The information at issue is what someone said about themselves when they first picked up the phone or filled out a form asking for help with a drug or alcohol problem. Whether it sat in a medical record or a sales database does not change what it reveals.
American Addiction Centers reported the breach to the California Attorney General on August 7, 2026 — roughly two months after it confirmed the theft, and nearly three months after the data was taken. It is offering affected individuals a membership in Privacy Solutions ID through Epiq, with the length of coverage varying by recipient.
The firm is examining how an outside party reached this information, why Social Security numbers were stored alongside intake inquiries at all, how the theft went undetected for weeks, and why notice took as long as it did. The firm is also examining the company's data security history: American Addiction Centers disclosed a separate breach in late 2024 that it reported as affecting more than 422,000 people, and litigation over that incident was still awaiting final court approval of a settlement when this one occurred.
WHAT HAPPENED?
wHY THIS MATTERS
Reaching out for help with an addiction is one of the hardest calls a person ever makes. People make it at a difficult point, often before telling their family, their employer, or anyone else. They give their name and their Social Security number because a treatment provider asks for them, and they describe what they are struggling with because they are asking for help.
The exposure here is unusually damaging for exactly that reason. A stolen Social Security number creates the familiar risks — fraudulent accounts, misused credit, tax fraud. But paired with a person's own description of their health and the fact that they contacted an addiction treatment company, it creates something worse: a record, in unknown hands, that someone sought treatment for a substance use problem.
Many of the people affected may never have become patients. Some may have called on behalf of a family member. Some potentially called once and never followed up. All of them now face the possibility that the most private thing about a period of their life is held by strangers who obtained it by theft.
wHO MAY BE AFFECTED
This investigation concerns individuals who contacted American Addiction Centers — by phone, online form, or other initial outreach — and whose information was taken in the May 12, 2026 incident. The company operates treatment facilities in California, including Laguna Treatment Center in Aliso Viejo, which draws patients from across Orange County, Los Angeles, and San Diego.
You may be affected if you called or submitted an inquiry to American Addiction Centers or one of its treatment centers or websites, provided your Social Security number and information about your health during that contact, and received a notification letter offering complimentary Privacy Solutions ID membership through Epiq.
You do not need to have entered treatment. You do not need to have been a patient at all. If you made contact and received a letter, this investigation concerns you.
Contact Noss & Russell, LLP
If you received a notice from American Addiction Centers about this incident, Noss & Russell, LLP would like to hear from you.
We understand that medical privacy is exactly that — private. What you tell us stays with us. Consultations are free, confidential, and carry no obligation, and the firm handles these matters on a contingency basis: you pay nothing unless we recover compensation for you.
Matters involving public health systems can carry particularly short deadlines for taking action. If you received one of these notices, we encourage you not to wait to speak with someone.
To speak with an attorney, contact Noss & Russell, LLP at (619)678-1880 or request a consultation below.