Acadia Healthcare Data Breach Exposes Social Security Numbers

Acadia Healthcare Company Inc., one of the largest behavioral healthcare providers in the United States, disclosed a data breach that occurred in March 2026 involving unauthorized access to patient information.

According to the company's investigation, an unauthorized party used social engineering to gain access to one employee email account and an associated SharePoint account at Acadia Healthcare. Social engineering is a technique where an attacker manipulates a person into providing access or sharing confidential information, rather than breaking into computer systems through technical means. SharePoint is a Microsoft platform that organizations use to store and share documents and files.

Between March 21 and March 25, 2026, the unauthorized party accessed and obtained certain emails and SharePoint files from these accounts. Upon learning of the incident, the company immediately secured the compromised accounts and launched an investigation with the assistance of a third-party forensic investigation firm.

The investigation confirmed that the breach was limited to the one email account and the associated SharePoint account.

The company then initiated a review to determine the contents of the emails and files that were involved in the incident. On May 15, 2026, as part of that ongoing review, the company determined that the compromised files contained patient information.

The types of information exposed included names, addresses, dates of birth, treatment information, dates of treatment, type of treatment and health insurance information. For some individuals, the files also contained their Medicare Health Insurance Claim Number (HICN), which may include their Social Security number. The notification letter sent to affected individuals also referenced dates of admission, diagnosis codes and status as a patient.

The breach was reported to the Massachusetts Office of Consumer Affairs and Business Regulation, with 405 Massachusetts residents identified as affected. Acadia Healthcare discovered the breach on March 25, 2026, and is notifying affected individuals beginning May 22, 2026. The company has posted a notice about the incident on its website.

Acadia Healthcare's response

Acadia Healthcare has set up a dedicated, toll-free incident response line for individuals who have questions about the breach. Affected individuals can call 888-500-5708, Monday through Friday from 8 a.m. to 8 p.m. Central Time, excluding major U.S. holidays.

In its notification letter, the company stated it is "committed to protecting the confidentiality and security of the information we maintain" and added, "We deeply regret any inconvenience or concern this incident may cause and take this matter seriously." The company recommended that affected individuals review statements they receive from their healthcare providers and health insurance plans.

The notification letter also included general information about placing fraud alerts and credit freezes with the three major credit bureaus, as well as guidance on reporting potential identity theft to the Federal Trade Commission and state attorneys general offices.