The National Association on Drug Abuse Programs (NADAP) is investigating a data security incident that was identified on January 10, 2026, and confirmed to have impacted data by January 27, 2026. A notice was posted on NADAP’s website on February 13, 2026, informing individuals that their personal and health information may have been exposed.
The breach potentially affected over 400,000 individuals, including clients and employees, primarily in New York. The exposed data may include names, Social Security numbers, dates of birth, addresses, Medicaid/government IDs, health insurance information, medical/health details (including treatments, diagnoses, electronic health records, and behavioral health records), tax information, financial information, and clinical information. While a ransomware group claimed exfiltration of 2 TB of data, NADAP has not publicly acknowledged this. The exact final count of affected individuals from NADAP has not been released.
Data breach incidents can be complex, and additional details often emerge as investigations progress. Notifications to affected individuals may also be delayed.