Ransomware Group Hits Substance Abuse Treatment Service

Substance abuse treatment company American Addiction Centers said attackers stole personal data pertaining to nearly half a million patients.

See Also: Advancing Cyber Resiliency With Proactive Data Risk Reduction

The Tennessee company alerted regulators by saying the incident affected 422,424 individuals.

Founded in 2007, American Addiction Centers says it offers “the largest network of rehab facilities nationwide.” The for-profit company operates eight in-patient as well as eight outpatient treatment centers across California, Florida, Massachusetts, Mississippi, Nevada, Rhode Island and Texas.

In a data breach notification dated Tuesday being mailed to victims, the substance-abuse treatment service said the breach began around Sept. 23, and was first spotted around Sept. 26. The company said that on Oct. 3, investigators found attackers successfully stole patient data over that four-day period.

The company said the intrusion is being investigated by law enforcement.

The data breach exposed each victim’s name, address, phone number, date of birth, medical record number or another identifier, Social Security number and health insurance information, it said. The fact that an individual was a patient at an addiction treatment center is also private information.

The Rhysida ransomware operation claimed last month to have perpetrated the attack and data theft. In a Nov. 16 post to its data leak site, the group set a seven-day countdown timer, demanding a ransom be paid in return for a promise to delete what it said amounted to 2.8 terabytes of stolen data.

Since mid-2023, the Rhysida group has continued to hit healthcare and public health sector organizations, this year including a Chicago pediatric hospital, a Colorado mental health provider, substance abuse and other healthcare services, as well as health systems in Delaware and Rhode Island, among other targets (see: Breach Roundup: Rhysida Ransom Gang Cops to Hospital Hacks).

After AAC apparently refused to pay, the attackers claimed to be offering the stolen data for 20 bitcoins – worth about $1.9 million as of Friday – to the highest bidder, after which the group claimed to have sold 10% of it and leaked the rest for free online.

Those claims couldn’t be verified. Ransomware-hunting experts have found that such claims are often a ruse designed to increase the psychological pressure on victims as the wantonly self-promoting criminals attempt to make themselves look big and scary (see: Ransomware Groups’ Data Leak Blogs Lie: Stop Trusting Them).

American Addiction Centers made news in 2014 when it became the first publicly traded addiction-treatment provider in the U.S., with parent company AAC Holdings listed on the New York Stock Exchange. Five years later, the firm was struggling, in part due to changes in how private insurance firms reimburse addiction treatment, reported Behavioral Health Business.

After months of delisting warnings, the NYSE delisted the firm in October 2019 for failing to maintain a $15 million market cap over a 30-day trading period.

The company filed for bankruptcy protection in June 2020, from which it emerged in December 2020. The company’s stock trades over the counter.