American Addiction Centers $2.75M Data Breach Settlement, Patients Get Up To $5,000 For 2024 Cyberattack—Claim Deadline March 23, 2026
American Addiction Centers agreed to a $2.75 million settlement for approximately 423,000 patients and employees whose sensitive health information was compromised in a September 2024 cyberattack. Class members can claim up to $5,000 for documented losses, an estimated $50 pro-rata cash payment, or two years of free credit monitoring. The claim deadline is March 23, 2026, and preliminary approval was granted December 5, 2025.
If American Addiction Centers notified you about the data breach in late 2024, you automatically qualify for settlement benefits—but you must file a claim to receive payment.
What Is the American Addiction Centers Settlement About?
On September 26, 2024, unauthorized parties gained access to American Addiction Centers’ internal computer systems, compromising highly sensitive patient and employee information for over 423,000 individuals.
The compromised data included names, addresses, phone numbers, dates of birth, Social Security numbers, medical record numbers, treatment information, and health insurance details—some of the most private information people share with healthcare providers.
The lawsuit, In re American Addiction Centers Inc. Data Breach Litigation, pending in the U.S. District Court for the Middle District of Tennessee (Judge William L. Campbell Jr.), alleges American Addiction Centers failed to implement adequate cybersecurity measures to protect this sensitive data.
American Addiction Centers notified potentially affected individuals between November and December 2024. The company denies all allegations and maintains it did nothing wrong, agreeing to settle to avoid prolonged litigation.
Who Qualifies for the Settlement?
You’re eligible if American Addiction Centers identified you as someone whose private information was potentially compromised in the September 26, 2024 data breach. Specifically, you received a data breach notification letter or email from American Addiction Centers in late 2024.
The settlement covers approximately 423,064 class members nationwide whose information was accessed or acquired by unauthorized third parties during the cyberattack.
How Much Can You Receive?
The settlement offers multiple compensation options—choose ONE:
Option 1: Documented Out-of-Pocket Losses
Up to $5,000 for expenses directly caused by the breach with proof, including:
- Identity theft restoration costs
- Fraudulent charges and bank fees
- Credit report fees and monitoring services
- Lost wages from time dealing with breach consequences
- Professional services (attorneys, accountants)
- Phone and postage costs related to breach response
Option 2: Pro Rata Cash Payment
Estimated $50 per person without documentation. The exact amount depends on how many class members file claims and settlement fund deductions for attorney fees and administration costs.
Option 3: Two Years Free Credit Monitoring
All class members can enroll in credit monitoring and identity theft protection through a major credit bureau at no cost, including at least $1 million in identity theft insurance.
Minimum Payment Rule: If your cash payment would be less than $10, you won’t receive a payout.
Similar to other healthcare data breach settlements like the Kaiser $47.5 million privacy case, the settlement aims to compensate victims while requiring improved data security practices.
How to File a Claim
Online Filing (Recommended): Visit www.AACSettlement.com and submit electronically by 11:59 p.m. on March 23, 2026.
Mail Filing: Download and complete the PDF claim form from www.AACSettlement.com and mail postmarked by March 23, 2026 to:
In re American Addiction Centers Inc. Data Breach Litigation
c/o Kroll Settlement Administration LLC
P.O. Box 5324
New York, NY 10150-5324
Required Information:
- Contact details (name, address, email, phone)
- Which settlement option you’re choosing
- Documentation if claiming out-of-pocket losses (receipts, invoices, bank statements, time logs)
Critical Deadlines
March 6, 2026: Opt-out and objection deadline
March 23, 2026: Claim submission deadline
April 20, 2026: Final approval hearing at 3:00 p.m. CT at Fred D. Thompson U.S. Courthouse, 719 Church Street, Courtroom 6B, Nashville, TN 37203
Payments will be distributed approximately 60-90 days after final approval and resolution of any appeals.
Why This Breach Matters
For addiction treatment patients, this breach is especially troubling. Treatment information is among the most sensitive health data someone can share. Exposure of substance abuse treatment records carries stigma, potential employment discrimination, and privacy violations that go far beyond typical data breaches.
The Health Insurance Portability and Accountability Act (HIPAA) requires healthcare providers to safeguard protected health information. When addiction treatment centers fail to implement reasonable cybersecurity measures, they violate both federal healthcare privacy laws and state consumer protection statutes.
This settlement demonstrates that healthcare providers handling sensitive addiction treatment records face serious legal consequences for data security failures, similar to accountability in other major healthcare data breach cases.
Common Filing Mistakes
Missing Documentation: If claiming out-of-pocket losses, incomplete documentation will result in claim denial or reduction. Gather receipts, invoices, and time logs before filing.
Late Submission: The March 23, 2026 deadline is firm. Late claims won’t be processed.
Choosing Wrong Option: If you have documented losses exceeding $50, choose Option 1. If losses are less than the estimated pro-rata payment, choose Option 2.
Not Updating Contact Information: If your address changed since the breach notification, update it when filing your claim so you receive payment.
Tax Implications
Settlement payments for identity theft and data breach compensation may be taxable income. Kroll Settlement Administration will issue IRS Form 1099 for payments meeting reporting thresholds. Consult a tax professional about your specific situation.
Settlement Administrator Contact
Kroll Settlement Administration LLC
Website: www.AACSettlement.com
Phone: Available on settlement website
Email: Available on settlement website
Mail: P.O. Box 5324, New York, NY 10150-5324
Frequently Asked Questions
Do I need proof I suffered identity theft to claim?
No. You can claim the estimated $50 pro-rata cash payment without any documentation. Only Option 1 (up to $5,000) requires proof of actual out-of-pocket losses.
What if I didn’t receive a breach notification?
Contact Kroll Settlement Administration through www.AACSettlement.com to verify your eligibility. Some notifications may have been sent to outdated addresses.
Can I claim both cash payment and credit monitoring?
No. You must choose one: documented losses (Option 1), pro-rata cash (Option 2), OR credit monitoring (Option 3). You cannot receive multiple benefits.
What if my loss exceeds $5,000?
The settlement caps individual reimbursement at $5,000 per person. Losses exceeding this amount cannot be recovered through the settlement, though you could opt out and pursue individual litigation.
When will I receive payment?
Payments distribute approximately 60-90 days after the April 20, 2026 final approval hearing, assuming no appeals delay the process. Expect checks or electronic payments in summer 2026.
Should I enroll in the free credit monitoring?
If you don’t have existing credit monitoring and don’t have documented out-of-pocket losses, the two years of free monitoring with $1 million identity theft insurance provides valuable protection.
Last Updated: January 19, 2026
Disclaimer: This article provides general information about the American Addiction Centers Data Breach Class Action Settlement based on court documents and settlement administrator information. It does not constitute legal or medical advice. Settlement terms are subject to final court approval. For specific questions about your eligibility or claim, visit www.AACSettlement.com or consult a qualified attorney.
Sources:
- In re American Addiction Centers Inc. Data Breach Litigation – U.S. District Court for the Middle District of Tennessee
- December 5, 2025 Preliminary Approval Order
- www.AACSettlement.com – Official Settlement Website
- Kroll Settlement Administration – Settlement Administrator
Stay informed, stay protected. — AllAboutLawyer.com
About the Author
Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah