National Association on Drug Abuse Problems (NADAP) Data Breach

Key facts: NADAP data breach

• Date reported: March 24, 2026.
• Unauthorized access identified: January 10, 2026.
• Target entity: National Association on Drug Abuse Problems (NADAP).
• Source of breach: Unknown, unauthorized third-party.
• Data types: Full names, Social Security numbers, dates of birth, medical diagnoses, health insurance information, and financial/tax details.
• Status: Confirmed; forensic investigation concluded on January 27, 2026.
• Severity: High; involves approximately 90,000 individuals and includes permanent identifiers and protected health information (PHI).

What happened in the NADAP data breach?

The National Association on Drug Abuse Problems (NADAP), a New York-based nonprofit operating via nadap.org, disclosed a significant cybersecurity incident on March 24, 2026. The organization first detected unauthorized activity on its network on January 10, 2026. A subsequent forensic investigation, which concluded on January 27, 2026, confirmed that an unauthorized third party gained access to sensitive files containing protected health information (PHI) and personal identifiers. While the investigation identified the scope of the exposure, no specific threat actor has claimed responsibility for the attack.

The breach affected approximately 90,000 individuals, exposing a wide range of sensitive data including Social Security numbers, medical diagnoses, and financial details. The severity of this incident is classified as high due to the combination of permanent identifiers and private health records. In response, NADAP has updated its security protocols by strengthening password requirements and deploying conditional access policies. This type of exposure typically leads to heightened risks of targeted phishing and identity exploitation.

Who is behind the incident?

The attacker or cause of the incident has not been identified.

Impact and risks for NADAP customers

For the 90,000 individuals affected by the NADAP breach, the exposure of Social Security numbers and medical information presents a substantial risk of identity theft and financial fraud. Malicious actors could potentially use this data to open fraudulent lines of credit, file deceptive tax returns, or exploit health insurance benefits. Furthermore, the inclusion of diagnostic and health insurance information increases the likelihood of sophisticated social engineering attacks, where fraudsters pose as healthcare providers to solicit further sensitive information or payments.

Victims of health data breaches often face long-term administrative challenges in restoring their digital identity and securing their financial accounts. Affected individuals should immediately place a fraud alert or credit freeze on their credit reports and closely monitor their insurance Explanation of Benefits (EOB) statements for unauthorized services. Proactive transparency from the affected organization is vital for helping victims mitigate these ongoing risks.

How to protect against similar security incidents

In light of the NADAP breach involving Social Security numbers and sensitive health data, it is critical for affected individuals to take immediate steps to secure their personal information.

• ‍Monitor financial and insurance accounts. Regularly review bank and credit card statements for any transactions you do not recognize. Carefully check health insurance Explanation of Benefits (EOB) statements to ensure all listed services were actually received.‍
• Implement a credit freeze. Contact the three major credit bureaus—Equifax, Experian, and TransUnion—to place a freeze on your credit file. This prevents unauthorized parties from opening new credit accounts in your name using your Social Security number.‍
• Enhance credential security. Change passwords for all sensitive accounts, ensuring each one is unique and complex. Enable multi-factor authentication (MFA), preferably using an authenticator app or hardware key, to add a layer of security beyond passwords.‍
• Deploy attack surface management. Organizations should utilize continuous monitoring tools to identify and secure vulnerable network entry points. Regularly review and update conditional access policies to ensure only authorized users and devices can access sensitive data environments.

Taking these proactive measures is essential to reducing the potential impact of data exposure and maintaining long-term digital security.

Frequently asked questions

What happened in the NADAP security breach?

On March 24, 2026, NADAP (nadap.org) disclosed a security breach. According to initial reports, unauthorized access to the nonprofit's network resulted in the exposure of sensitive protected health information and financial data for approximately 90,000 individuals.

When did the NADAP breach occur?

The NADAP breach was publicly reported on March 24, 2026. The organization first detected the incident on January 10, 2026, and completed its forensic investigation on January 27, 2026.

What data was exposed?

The types of data involved in the NADAP incident include names, Social Security numbers, dates of birth, medical or health information, diagnostic information, health insurance information, and tax or financial information. This page will be updated as verified information becomes available.

Is my personal information at risk?

If you interacted with NADAP, there's a possibility your personal information could be affected. Similar incidents often involve email addresses, login details, or financial records. Stay alert for updates and take precautionary measures to secure your accounts.

How can I protect myself after a data breach?

• Change passwords for all sensitive accounts
• Enable multi-factor authentication (MFA)
• Monitor financial and insurance statements for suspicious activity
• Place a credit freeze or fraud alert with major credit bureaus
• Use breach monitoring tools to stay informed of data leaks

What steps should companies take after being breached?

NADAP has moved to secure its systems by strengthening password requirements and implementing conditional access policies. The organization is notifying affected individuals and advising them to monitor their financial and insurance records for signs of fraud.

This cybersecurity news article is powered by UpGuard Breach Risk — continuous attack surface monitoring for your organisation and supply chain.