Acadia Healthcare Data Breach Exposes Patient Information in Social Engineering Attack On March 25, 2026, Acadia Healthcare, a provider operating 277 behavioral health facilities across 40 states and Puerto Rico, detected unauthorized access to a user’s email and associated SharePoint account. An investigation revealed that a threat actor, leveraging social engineering tactics, accessed and exfiltrated sensitive files between March 21 and March 25. While Acadia’s core electronic health record systems remained uncompromised, the exposed data included patients’ names, addresses, dates of birth, treatment details, health insurance information, and Medicare Health Insurance Claim Numbers some of which contained Social Security numbers. Notifications to affected individuals began on May 22, 2026. Legal teams, including those affiliated with ClassAction.org, are exploring potential class action litigation on behalf of impacted patients, citing risks such as identity theft, privacy violations, and financial harm. The incident underscores vulnerabilities in third-party and email-based systems within healthcare security.

Acadia Health LLC, a Louisiana-based healthcare provider, experienced a data breach in 2023 that exposed the personal information of nearly 130,000 individuals, including Social Security numbers (SSNs). The breach resulted from alleged negligence in safeguarding sensitive data, leading to a proposed class-action settlement of $875,000. Affected individuals—particularly those with exposed SSNs—are eligible for reimbursement of up to $10,000 for documented losses, while adult subclass members can claim up to $12,500. Minors impacted by the breach will receive 10 years of identity-theft protection. The settlement also includes pro rata cash payments for other affected parties. The exposure of such highly sensitive data (SSNs) poses severe risks, including identity theft, financial fraud, and long-term reputational harm to the victims. The incident underscores critical failures in Acadia Health’s cybersecurity measures, particularly in protecting patient and employee confidentiality in the healthcare sector.