Acadia Healthcare, the behavioral health provider, is notifying people that files an unauthorized party took in March and July 2026 through an email security incident contained their names and Social Security numbers, along with health, insurance or financial details for some. It is offering one year of free credit monitoring; no lawsuit over the breach had been identified as of November 15, 2026, and there is nothing to claim.
Breach Notice · No Lawsuit Confirmed · Nothing to Claim
This page reports a data breach notice. Acadia Healthcare has not been found liable for anything, OCA has not identified a lawsuit over the breach, no class has been certified, and there is nothing to claim. This page is informational and is not legal advice.
What Is This About?
Acadia Healthcare Company, Inc., which operates behavioral health and addiction treatment facilities, is notifying people about an email security incident that led to the theft of certain files. Acadia filed a sample of its notice with the California Attorney General on November 13, 2026.According to the notice, Acadia first learned of the incident on March 25, 2026 and opened an investigation with an outside forensic firm. The investigation found that an unauthorized party accessed and acquired certain files between March 21 and March 25, 2026, and again on July 13, 2026. Acadia says its electronic health record systems were not involved and that patient care was not disrupted. On August 21, 2026, its review determined whose information was in the files. Acadia has not said how many people are being notified.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Information Was Involved?
The notice says each affected file contained the person’s name and Social Security number together with one or more of the following: address, date of birth, diagnosis, lab results, medications, treatment information, health insurance information, provider names, dates of service, payment card information and bank account information. The exact combination varies by person and is stated in each letter.That mix is broader than most breach notices. It pairs the information used for identity theft with treatment details from behavioral health and addiction care, which federal law treats as especially sensitive, and for some people adds the payment card or bank account information used for financial fraud.
The Second Access Date
The notice lists two separate windows: March 21 to 25, 2026, and July 13, 2026, nearly four months after Acadia says it first learned of the incident. The letter does not explain how files were taken again in July or whether the two events were connected. Questions about why the same intrusion could recur after discovery are the kind that breach lawsuits commonly raise.What Acadia Is Offering
Acadia is offering a free one-year membership to credit monitoring and identity theft protection through Epiq Privacy Solutions ID. Enrollment uses the activation code in the letter, and the enrollment deadline is printed in each letter. Acadia says it is adding cybersecurity training for providers and staff.Federal law also gives anyone notified of a breach free access to fraud alerts and security freezes through the three national credit bureaus, and the Federal Trade Commission’s IdentityTheft.gov site explains how they work. People whose card or bank account numbers were listed can ask their bank or card issuer about monitoring or replacing the account.
Has a Lawsuit Been Filed?
As of November 15, 2026, OCA had not identified a class action over the Acadia Healthcare email breach. This is a different company from Acadia Health, LLC, the Louisiana dental group that does business as Just Kids Dental, whose 2023 breach is covered on OCA’s Just Kids Dental page. OCA will update this page if a complaint is filed or Acadia reports how many people were affected.Questions
What information was exposed in the Acadia Healthcare data breach?
According to Acadia’s notice, the affected files contained each person’s name and Social Security number plus one or more of: address, date of birth, diagnosis, lab results, medications, treatment information, health insurance information, provider names, dates of service, payment card information and bank account information. The combination varies by person.
When did the Acadia Healthcare breach happen?
Acadia says it learned of an email security incident on March 25, 2026. Its investigation found that an unauthorized party accessed and acquired files between March 21 and 25, 2026, and on July 13, 2026. On August 21, 2026 it determined whose information was involved. A sample notice was filed with the California Attorney General on November 13, 2026.
Were Acadia’s medical record systems hacked?
No, according to the notice. Acadia says the investigation confirmed that its electronic health record systems were not involved and that the incident did not disrupt patient care. The information came from files reached through the email incident.
Is this the Just Kids Dental (Acadia Health) breach?
No. Acadia Healthcare Company, Inc. is a behavioral health company. Acadia Health, LLC, which does business as Just Kids Dental, is a separate dental group whose 2023 breach led to a separate settlement.
Is there an Acadia Healthcare data breach class action?
OCA had not identified a filed class action over this breach as of November 15, 2026. There is no settlement, fund or claim form. OCA will update this page if a lawsuit is filed.
Sources
• California Attorney General — Acadia Healthcare Company, Inc. breach report and sample notice• Federal Trade Commission — IdentityTheft.gov
