NADAP Data Breach 2026 (Genesis Ransomware): 90,000 NY Substance-Use & Health-Home Patients Exposed. 42 CFR Part 2 Risk. What To Do

What happened

NADAP (National Association on Drug Abuse Problems) is a New York-based 501(c)(3) nonprofit founded in 1971 and headquartered in Manhattan. It serves approximately 35,000 underserved New Yorkers per year across seven NYC and Long Island sites. Services include substance-use disorder care coordination, Lead Health Home care management under contract with NYC Health + Hospitals, Project ACE, the Substance Abuse Centralized Assessment Program (NY OASAS-licensed), wellness, and workforce development.

On November 26, 2025, an unauthorized actor began accessing NADAP’s network. The activity was detected on January 10, 2026, and impacted systems were isolated. Forensic review confirmed PHI involvement on January 27, 2026, when NADAP also notified NYC Health + Hospitals about the affected Lead Health Home patient cohort.

NADAP filed with the HHS Office for Civil Rights on February 13, 2026, confirming 90,000 affected individuals. On March 7, 2026, the Genesis ransomware group listed NADAP on its dark-web leak site, claiming approximately 2 TB of exfiltrated data and explicitly citing NADAP’s Medicaid and NY state grant funding as motivation. NADAP posted its substitute notice on March 24, 2026. Of the 90,000 total, 5,086 are NYC Health + Hospitals Lead Health Home patients.

42 CFR Part 2 implications

Because NADAP provides substance-use disorder care coordination, a meaningful portion of the affected records is likely protected under 42 CFR Part 2 in addition to HIPAA. Part 2 imposes stricter redisclosure rules than HIPAA and gives affected individuals additional rights when SUD treatment records are improperly disclosed. NADAP’s substitute notice does not explicitly invoke Part 2, but the federal OCR enforcement program for Part 2 launched on February 16, 2026 — three days after NADAP’s OCR filing — placing this incident in the first cohort potentially subject to a dual HIPAA + Part 2 enforcement review.

What was stolen

Exposed data per NADAP’s notice and corroborating reporting:

• Full name
• Social Security number
• Date of birth
• Home address
• Medicaid ID
• Medical and health information
• Healthcare treatment or diagnostic information
• Health insurance information
• Tax and financial information

NYC H+H’s parallel notice specifies “clinical information related to their health home care” for the 5,086-person subset.

What NADAP is offering

NADAP’s substitute notice reportedly does not offer complimentary credit monitoring, directing affected individuals instead to self-help fraud-alert and credit-freeze procedures. Call center: 1-855-522-0352. NYC H+H’s parallel notice describes NADAP as having “offered credit monitoring resources” — which appears to mean self-help guidance rather than a funded enrollment.

What to do

1. Place free credit freezes at Equifax, Experian, and TransUnion. Full SSN is in scope; the freeze is essential.
2. Pull a free credit report at annualcreditreport.com.
3. File IRS Form 14039 to prevent fraudulent tax-return filings.
4. If you are a Medicaid beneficiary, watch your Explanation of Benefits for unfamiliar claims billed against your Medicaid ID.
5. Exercise NY GBL § 899-aa rights if you are a New York resident. NADAP was statutorily required to notify the NY Attorney General, NY DOS Consumer Protection, NY State Police, and NYDFS within 30 days of discovery.
6. Stop the ongoing flow of your SUD treatment records. HealthConsent files Part 2 redisclosure restrictions, HIPAA restriction requests, and state-law deletion requests so the substance-use treatment data exposed in this breach is not continuously re-shared by downstream entities.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches