---
title: "Acadia Healthcare email and SharePoint data incident"
description: "Evidence-backed account of Acadia Healthcare email and SharePoint data incident, covering what happened, impact, timeline, attack vector, technical details, and primary sources."
incident_type: "Data incident"
status: "active"
last_modified: "2026-08-09"
canonical_url: "https://www.ally.security/incidents/acadia-healthcare-email-sharepoint-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/acadia-healthcare-email-sharepoint-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/acadia-healthcare-email-sharepoint-data-incident-2026/stix.json"
---

# Acadia Healthcare email and SharePoint data incident

Unauthorized access to and acquisition of emails and SharePoint files after social engineering compromised one user email account. Patient information contained in the affected email and SharePoint files.

Last modified Aug 9, 2026 · 3 sources

## Summary

- **Environment:** Not publicly identified
- **Operational impact:** No outage or recovery duration quantified
- **Financial impact:** No public cost estimate

## What happened

[Acadia Healthcare](https://www.acadiahealthcare.com/) disclosed unauthorized access to and acquisition of emails and SharePoint files after social engineering compromised one user email account. [1](#source-1)

## Impact

Patient information contained in the affected email and SharePoint files. [1](#source-1) [2](#source-2) [3](#source-3)

Documented data types include:

- Social Security numbers — For some individuals, a Medicare Health Insurance Claim Number may have included a Social Security number; this does not apply to every affected individual. [1](#source-1)
- Dates of birth — The affected information varied by individual. [1](#source-1)
- Names — The affected information varied by individual. [1](#source-1)
- Health insurance information — The affected information varied by individual. [1](#source-1)
- Clinical information — Treatment information, including dates and types of treatment; fields varied by individual. [1](#source-1)
- Contact information — Acadia identified addresses among the information involved; fields varied by individual. [1](#source-1)

A cited record reports 1,807 individuals (Individuals listed for Acadia in the HHS OCR incident portal; treated as a regulator-reported count, not independently verified; as of 2026-08-08). [1](#source-1) [2](#source-2) [3](#source-3)

A cited record reports 405 individuals (Massachusetts residents listed in incident record 2026-840; this is not a national total; as of 2026-05-22). [1](#source-1) [2](#source-2) [3](#source-3)

Acadia reported that the incident did not disrupt its operations or its ability to care for patients. [1](#source-1)

The unauthorized party accessed and acquired certain emails and SharePoint files. [1](#source-1)

## Timeline

### March 21, 2026 — Activity began

Unauthorized access to and acquisition of emails and SharePoint files after social engineering compromised one user email account. [1](#source-1)

### March 25, 2026 — Discovery

Date Acadia detected unusual activity in a user's email account. [1](#source-1)

### March 25, 2026 — Documented activity ended

End of the access-and-acquisition interval reported by Acadia. [1](#source-1)

### May 22, 2026 — Documented event

Date Acadia says it began notifying patients whose information was involved. [1](#source-1)

### August 9, 2026 — Briefing updated

This briefing was last reviewed and updated on August 9, 2026.

## Threat Group & Attack Vector

Acadia determined that social engineering was used to gain access to one user email account and its associated SharePoint account. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Acadia secured the email account, engaged a third-party forensic investigation firm, and added safeguards and technical controls. Acadia reported that the incident was limited to one email account and its associated SharePoint account and did not involve its electronic health record systems. No access path, attribution, scale, or recovery detail is inferred beyond the cited claims. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/acadia-healthcare-email-sharepoint-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Notice of Data Security Incident

official · Acadia Healthcare Company, Inc.

<https://www.acadiahealthcare.com/notice-of-data-security-incident/>

<a id="source-2"></a>

### 2026 Data Breach Notification Report

regulatory · Massachusetts Office of Consumer Affairs and Business Regulation

<https://www.mass.gov/doc/data-breach-report-2026/download>

<a id="source-3"></a>

### Breach Portal current investigation table

regulatory · U.S. Department of Health and Human Services Office for Civil Rights

<https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   March 2026 Acadia Healthcare email and SharePoint incident: Acadia reported that the incident did not disrupt its operations or its ability to care for patients.
2. **Resulted In · 100% confidence · current**  
   March 2026 Acadia Healthcare email and SharePoint incident: Acadia affected-patient notification
3. **Resulted In · 100% confidence · current**  
   March 2026 Acadia Healthcare email and SharePoint incident: Acadia secured the email account, engaged a third-party forensic investigation firm, and added safeguards and technical controls.
4. **Resulted In · 100% confidence · current**  
   March 2026 Acadia Healthcare email and SharePoint incident: Acadia determined that social engineering was used to gain access to one user email account and its associated SharePoint account.
5. **Discovered At · 100% confidence · current**  
   March 2026 Acadia Healthcare email and SharePoint incident: 2026-03-25
6. **Affected Organization · 100% confidence · current**  
   March 2026 Acadia Healthcare email and SharePoint incident: Acadia Healthcare Company, Inc.
7. **Resulted In · 100% confidence · current**  
   March 2026 Acadia Healthcare email and SharePoint incident: Acadia reported that the incident was limited to one email account and its associated SharePoint account and did not involve its electronic health record systems.
8. **Exposed Data Category · 100% confidence · current**  
   Acadia patient-information exposure: Social Security numbers
9. **Exposed Data Category · 100% confidence · current**  
   Acadia patient-information exposure: Dates of birth
10. **Exposed Data Category · 100% confidence · current**  
   Acadia patient-information exposure: Names
11. **Exposed Data Category · 100% confidence · current**  
   Acadia patient-information exposure: Health insurance information
12. **Resulted In · 100% confidence · current**  
   March 2026 Acadia Healthcare email and SharePoint incident: Acadia patient-information exposure
13. **Exposed Data Category · 100% confidence · current**  
   Acadia patient-information exposure: Clinical information
14. **Occurred At · 100% confidence · current**  
   Acadia affected-patient notification: 2026-05-22
15. **Resulted In · 100% confidence · current**  
   Acadia patient-information exposure: The unauthorized party accessed and acquired certain emails and SharePoint files.
16. **Affected Individual Count · 100% confidence · current**  
   Acadia patient-information exposure: 1,807 individual
17. **Exposed Data Category · 100% confidence · current**  
   Acadia patient-information exposure: Contact information
18. **Began At · 100% confidence · current**  
   March 2026 Acadia Healthcare email and SharePoint incident: 2026-03-21
19. **Affected Individual Count · 100% confidence · current**  
   Acadia patient-information exposure: 405 individual
20. **Ended At · 100% confidence · current**  
   March 2026 Acadia Healthcare email and SharePoint incident: 2026-03-25

</details>