In September 2024, American Addiction Centers (AAC) experienced a significant cyberattack that exposed the personal and health-related information of 422,424 individuals. The breach involved sensitive data such as Social Security numbers and health insurance details, prompting AAC to take immediate action to address the situation and support those impacted.
The cyberattack occurred over three days, from September 23 to September 26, 2024. AAC identified the breach on September 26 and quickly launched an investigation. The organization engaged third-party cybersecurity experts and notified law enforcement to assess the extent of the attack. By October 3, investigators confirmed that unauthorized individuals had accessed and stolen data during the breach.
Data Compromised
The stolen information included:
AAC assured clients that no treatment information or payment card data was compromised during the incident. While the exposed data could be exploited for identity theft, the company emphasized that there is no evidence linking the breach to fraudulent activity at this time.
Response and Notifications
In December 2024, AAC began notifying affected individuals, with official letters sent out just before the holiday season. These notifications outlined the breach details, the steps AAC had taken to address the incident, and the measures implemented to prevent future occurrences.
To mitigate risks, AAC offered affected individuals complimentary credit monitoring services for 12 months. The organization partnered with Cyberscout, a TransUnion company, to provide identity protection services, including:
Affected individuals are encouraged to enroll in these services by March 31, 2025, to ensure their data remains protected.
Beyond immediate support, AAC implemented enhanced security protocols to strengthen its cybersecurity defenses. The organization collaborated with leading cybersecurity experts to fortify its systems and continues to review and update its measures regularly. Additionally, AAC established a dedicated hotline to assist individuals with inquiries and provide guidance on protective measures.
Proactive Recommendations
Although AAC has found no evidence of identity theft linked to the breach, it urged affected individuals to take the following proactive measures:
AAC’s notification letters include detailed instructions on these steps to help individuals safeguard their personal information against potential threats.
AAC emphasized its dedication to protecting personal information and maintaining transparency with its clients. “We regret that this incident occurred and the concern it may have caused,” the company stated. “We take the confidentiality and security of personal information very seriously and will continue to take steps to prevent a similar incident from occurring in the future.
As investigations into the incident continue, AAC remains focused on strengthening its cybersecurity measures and rebuilding client trust. For further information, individuals can contact AAC’s dedicated hotline at 1-833-833-2770, available Monday through Friday from 8:00 a.m. to 8:00 p.m. Eastern Time.
This incident highlights the importance of robust cybersecurity measures and proactive data protection strategies to safeguard sensitive information in the digital age.
A huge data security breach has come to light, with the data platform Builder.ai. It's a service that lets organizations build their own proprietary, custom software applications, which don't need heavy programming. According to a blog post by a security researcher, sensitive information from more than three million users' accounts was inadvertently leaked to the internet, leaving an open question of what now?
Jeremiah Fowler, a cybersecurity expert known for discovering unsecured online databases, found a Builder.ai archive with over 3 million records. This archive reportedly contained 1.29 terabytes of data, including very sensitive materials such as invoices, NDAs, email screenshots, and tax documents.
Worryingly, files contained access keys and configurations of two cloud storage systems. These keys, in the wrong hands, could grant hackers access to even more sensitive data.
What Was Exposed
The exposed database included the following:
337,434 invoices: The documents comprised transactions between Builder.ai and its clients.
32,810 master service agreements: Most agreements included user names, e-mail addresses, IP details and project estimations of the cost associated with a particular project giving a holistic overview of their sensitive information.
Such data left unprotected poses grave risks. This information could be used for phishing scams, identity theft, or even financial fraud by criminals. Phishing is the art of making people give up their personal information by claiming to be a trusted person. The presence of cloud storage keys in the database further increases the worry, as this may also open access to more sensitive files elsewhere.
Fowler quickly notified the company, Builder.ai. However, the company, in its defense, showed that it could not tighten the database security due to "complexities with dependent systems." It is already a month, and nobody knows if the problem persists.
Misconfigured databases are one of the constant problems of the digital era. Companies don't realize they have a shared responsibility to secure the data when it comes to cloud services, leaving large repositories of information exposed unintentionally.
For businesses, this is an important wake-up call regarding comprehensive cybersecurity practices- periodic checks and ensuring the databases are properly secured for users' data protection.
For users, vigilance is key. Anyone who's interacted with Builder.ai should keep an eye out on their accounts for anything weird and be on their toes for phishing scams.
And in this hyperconnected world, security breaches such as this remind us that vigilance is key, too, for companies as much as it is for their users.