{ "type": "bundle", "id": "bundle--d5b3517c-72a7-5f10-83f0-34bf63bab19a", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--bd3a118f-c2d3-58e1-85e6-48e73972b447", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "org:5066689e-622a-41aa-8c41-cb46aceabe49", "name": "Acadia Healthcare Company, Inc.", "identity_class": "organization" }, { "type": "incident", "spec_version": "2.1", "id": "incident--46b5bab5-1196-5c7d-86e2-ad7abbe5019d", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "brh:a39daf8c-5032-4094-bd69-778b84316d2d", "name": "Acadia Healthcare email and SharePoint data breach" }, { "type": "incident", "spec_version": "2.1", "id": "incident--c5d66937-9a46-59cd-84c2-937326217c4d", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "inc:91fa41da-a1bc-430d-a831-14f9b7eaeed3", "name": "March 2026 Acadia Healthcare email and SharePoint incident" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0319b3b9-c0cb-57db-8bdd-0a8806f14f9e", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:735f37de-c294-400d-bd04-1939f92d0821", "relationship_type": "exposed-data-category", "source_ref": "x-ally-data-exposure--fe96d06c-12bb-5a83-8f6f-43d8482f3486", "target_ref": "x-ally-data-category--ab430a0e-23bc-5177-814b-26f716196ca0", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:1ce30f57-6f3f-422e-8e6c-2f6bf77bec28", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0d9d3bf9-7b23-5c39-80c0-8ddf8924186e", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:9cf76a3d-e39b-45e5-be72-9778d04a5ebc", "relationship_type": "exposed-data-category", "source_ref": "x-ally-data-exposure--fe96d06c-12bb-5a83-8f6f-43d8482f3486", "target_ref": "x-ally-data-category--a2b7dd9d-0c02-5710-88ed-ea507d0ffa07", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:0a93134d-6782-4ebd-a9b2-8f4916dedca4", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1d237f60-d756-5474-89e9-487255d923ad", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:1a04acb6-1a59-42b6-82f3-23d02d967faf", "relationship_type": "resulted-in", "source_ref": "incident--c5d66937-9a46-59cd-84c2-937326217c4d", "target_ref": "x-ally-notification--9baf02fd-cab6-5baf-817d-748ae5543826", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:a7c0b351-acb3-438b-a2ed-62a9a2c2e033", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3234df00-a999-595a-8d83-f8fe281e1e4b", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:e7f8506b-d7b5-4845-9d4c-754c44be308a", "relationship_type": "exposed-data-category", "source_ref": "x-ally-data-exposure--fe96d06c-12bb-5a83-8f6f-43d8482f3486", "target_ref": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:c73d7877-d8a7-4fd5-b159-12af85997dde", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3bb11456-c907-5672-87f7-ad8489d1103b", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:a62caa2a-afc5-4b33-abba-a00f645768e0", "relationship_type": "exposed-data-category", "source_ref": "x-ally-data-exposure--fe96d06c-12bb-5a83-8f6f-43d8482f3486", "target_ref": "x-ally-data-category--5329d6cf-09ca-5dfc-8375-07e683f85188", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:859fc3ba-eb23-451b-941b-979af8036fe0", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4398a818-a5f6-5830-85b3-1727536bf67b", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:a59471b1-333a-4a4c-ac83-c4988ae7104b", "relationship_type": "resulted-in", "source_ref": "incident--c5d66937-9a46-59cd-84c2-937326217c4d", "target_ref": "x-ally-data-exposure--fe96d06c-12bb-5a83-8f6f-43d8482f3486", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:8871c618-2415-4320-836b-815504e77937", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9e6bdf73-dfe3-5957-8a35-1493b26ec419", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:a135b539-2367-4b14-b0b4-cfbdfe7b10b4", "relationship_type": "exposed-data-category", "source_ref": "x-ally-data-exposure--fe96d06c-12bb-5a83-8f6f-43d8482f3486", "target_ref": "x-ally-data-category--9b7587c7-d30b-5e1d-8575-f6a11adf8425", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:dda8d71d-b24e-499e-b26b-c8455d8c722f", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a4358011-72db-5a5f-82ad-0862df5d19dc", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:73e5bc07-c7ba-4cf7-936e-1e2c66f7a99a", "relationship_type": "exposed-data-category", "source_ref": "x-ally-data-exposure--fe96d06c-12bb-5a83-8f6f-43d8482f3486", "target_ref": "x-ally-data-category--ff2c8174-4feb-535f-8a4d-be23ee26eff2", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:1ef4a0db-bc37-44ce-833e-073d3d661379", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a6dc2e81-8eb6-5403-8d63-db6ede53f64a", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:5d24eeb9-e32e-42a7-983c-ea1890d72097", "relationship_type": "affected-organization", "source_ref": "incident--c5d66937-9a46-59cd-84c2-937326217c4d", "target_ref": "identity--bd3a118f-c2d3-58e1-85e6-48e73972b447", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:cf22d7cc-fe0c-4073-ba7f-f2ae3b4579ad", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ] }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--0241ebab-32f6-5203-8fc7-e2ae79a9a4b5", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:f84c447c-fd2d-4df5-b5c6-e00f722cd17e", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:76abf5f0-377a-4053-874d-ffa25142b562", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-03-25" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--039cf0d2-c425-525f-80bc-f496b338fd53", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:d17affb6-b7f5-42c8-97a6-9dc9b8e0691d", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:3ae57ce1-7af2-4c9a-a998-8ed1e2edba71", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-05-22" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--0bc1d465-973f-55ad-8b95-272c24db401e", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:de980718-4102-4bc3-b240-35ee39a69e59", "confidence": 100, "external_references": [ { "source_name": "U.S. Department of Health and Human Services Office for Civil Rights", "url": "https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf", "external_id": "cit:dacea1c7-41a3-45b9-a1ba-95ca644ac085", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:bf8f6e5c0228d03313c55cba60fe37d12419f7be6d8c16b1541ac69a075d1d7b" } ], "x_ally_claim_object": { "kind": "value", "datatype": "integer", "value": 1807, "unit": "individual" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--5fad1e04-d722-5a06-802f-317ed1e281e3", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:3aeb028f-8673-4a60-b4e5-aff0f1efc29d", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:57f75f95-2128-42da-9d3d-71be656072d4", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Acadia determined that social engineering was used to gain access to one user email account and its associated SharePoint account." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--647e5c3a-7ee3-5c89-841f-269f1fe784c0", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:f684afb2-e432-4e75-8127-ffd204fc1074", "confidence": 100, "external_references": [ { "source_name": "Massachusetts Office of Consumer Affairs and Business Regulation", "url": "https://www.mass.gov/doc/data-breach-report-2026/download", "external_id": "cit:c8049d0a-ba1c-49fa-9228-a776afd740d3", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ead3dc85287618c6b9134045436f1f50cac56d0d4e0fe84d26ddf15bb97cbd4" } ], "x_ally_claim_object": { "kind": "value", "datatype": "integer", "value": 405, "unit": "individual" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--72ce18fb-0505-564b-8b4e-01f2658c11c0", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:526a442d-5756-45d0-b510-6d458c63e57d", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:c4b82beb-0d99-4396-98cd-6ee3109ae3c2", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-03-25" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--7e12928c-aa85-5b81-8811-5184ce86ce0b", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:11886ef4-cb96-4caa-b7ec-84eedc9f573d", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:d794581e-afaa-4ffa-9e0b-d40c62ab87da", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Acadia reported that the incident did not disrupt its operations or its ability to care for patients." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--8aed4f1a-0aef-5771-8408-4126d836f775", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:f2599972-b25e-454d-ba96-515aed3a856f", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:39fde9be-98b5-4b18-8a79-9012ca174683", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-03-21" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--c04fa59c-e90b-5f43-8a82-31004c7913c8", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:6ef1bdad-6fc8-4067-b4c0-1f6863ee21e6", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:3fc33ae3-81e7-4f26-ac25-5541caf8a08e", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Acadia reported that the incident was limited to one email account and its associated SharePoint account and did not involve its electronic health record systems." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--ce2a36ae-726d-5b97-8911-2ade0b81b820", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:d2cc6e83-c9a6-4808-b1e4-cce3a17f7836", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:586d11a1-6749-4ae1-8622-6e4764f5eb70", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The unauthorized party accessed and acquired certain emails and SharePoint files." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--f6e22cba-c1e6-5db6-8e33-040c6444ef60", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "clm:1c91a4ca-52a2-4a50-8399-fa36c0384c8b", "confidence": 100, "external_references": [ { "source_name": "Acadia Healthcare Company, Inc.", "url": "https://www.acadiahealthcare.com/notice-of-data-security-incident/", "external_id": "cit:4acc249c-81a4-4e86-835c-c6661821da9b", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:6d32fa328646dd6faba85f669eb93dfabeb57418666fe7a68604832217e3d568" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Acadia secured the email account, engaged a third-party forensic investigation firm, and added safeguards and technical controls." } }, { "type": "x-ally-data-category", "spec_version": "2.1", "id": "x-ally-data-category--5329d6cf-09ca-5dfc-8375-07e683f85188", "created": "2026-08-08T23:12:00Z", "modified": "2026-08-08T23:12:00Z", "x_ally_original_id": "dat:ff8b42ee-4a74-4d4d-a23f-1199c68c907f", "name": "Clinical information" }, { "type": "x-ally-data-category", "spec_version": "2.1", "id": "x-ally-data-category--9b7587c7-d30b-5e1d-8575-f6a11adf8425", "created": "2026-08-08T23:12:00Z", "modified": "2026-08-08T23:12:00Z", "x_ally_original_id": "dat:48e167a5-fbc8-433c-b6b7-ad170074a92d", "name": "Health insurance information" }, { "type": "x-ally-data-category", "spec_version": "2.1", "id": "x-ally-data-category--a2b7dd9d-0c02-5710-88ed-ea507d0ffa07", "created": "2026-08-08T23:12:00Z", "modified": "2026-08-08T23:12:00Z", "x_ally_original_id": "dat:559cf3f5-80c7-45ba-a930-ff0bfa8d17b0", "name": "Names" }, { "type": "x-ally-data-category", "spec_version": "2.1", "id": "x-ally-data-category--ab430a0e-23bc-5177-814b-26f716196ca0", "created": "2026-08-08T23:12:00Z", "modified": "2026-08-08T23:12:00Z", "x_ally_original_id": "dat:fcd11f98-14a8-47ac-adea-68ad2985528f", "name": "Social Security numbers" }, { "type": "x-ally-data-category", "spec_version": "2.1", "id": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231", "created": "2026-08-08T23:12:00Z", "modified": "2026-08-08T23:12:00Z", "x_ally_original_id": "dat:5abcee7e-4a37-494a-b6ba-87ff46149be9", "name": "Contact information" }, { "type": "x-ally-data-category", "spec_version": "2.1", "id": "x-ally-data-category--ff2c8174-4feb-535f-8a4d-be23ee26eff2", "created": "2026-08-08T23:12:00Z", "modified": "2026-08-08T23:12:00Z", "x_ally_original_id": "dat:ad54319a-bb47-40fb-be6c-7fd6e2aa1f68", "name": "Dates of birth" }, { "type": "x-ally-data-exposure", "spec_version": "2.1", "id": "x-ally-data-exposure--fe96d06c-12bb-5a83-8f6f-43d8482f3486", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "exp:7b341d36-ba5a-42de-946c-d88d1dbb2119", "name": "Acadia patient-information exposure" }, { "type": "x-ally-jurisdiction", "spec_version": "2.1", "id": "x-ally-jurisdiction--26a2a0d1-6423-54e9-8580-cb98986f2041", "created": "2026-08-08T23:12:00Z", "modified": "2026-08-08T23:12:00Z", "x_ally_original_id": "jur:baa42ab9-8b9f-4a7a-b8aa-b1fe626969ce", "name": "Massachusetts" }, { "type": "x-ally-notification", "spec_version": "2.1", "id": "x-ally-notification--9baf02fd-cab6-5baf-817d-748ae5543826", "created": "2026-08-08T23:50:00Z", "modified": "2026-08-08T23:50:00Z", "x_ally_original_id": "ntf:22ebf757-4e41-4939-99a3-36d85a7cbb54", "name": "Acadia affected-patient notification" } ] }