NADAP 2026 Data Breach (90 Thousand People Affected)

The 2026 NADAP data breach was a security incident involving unauthorized access to files in the National Association on Drug Abuse Programs network. The organization says the incident may have affected health and personal information belonging to certain clients, employees, and related individuals.

The U.S. Department of Health and Human Services Office for Civil Rights recorded the event as a hacking/information-technology incident involving a network server and reported 90,000 affected individuals.

Verified Incident Timeline

NADAP identified suspicious activity in its network on or around January 10, 2026, secured the environment, and began investigating with cybersecurity specialists. On or around January 27, the organization determined that some files contained protected health or personal information.

What Information May Have Been Affected?

The scope may vary by person. The notice lists names, Social Security numbers, dates of birth, medical or health information, healthcare treatment or diagnosis information, health-insurance information, and tax or financial information.

How the Organization Responded

NADAP says it implemented additional network-security measures, including stronger password requirements and conditional-access policies. The incident was reported to the federal health authority, New York agencies, partner organizations, and the FBI.

What Should Affected People Do?

Notice recipients should monitor financial accounts, credit reports, and health-insurance statements for unfamiliar transactions or services. People whose Social Security or financial information was affected may consider a fraud alert or credit freeze based on their circumstances.