HackingHealthcareHealthcareCustomer Data InvolvedEmployee Data InvolvedPHIGovernment IDIdentity (basic)Health (basic)MediumContained

National Association on Drug Abuse Problems

bd_1b88a600912e35dd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 10, 2026

Filed

Jul 14, 2026

To disclose

26 weeks

Affected

7state residents only

Linked

3 filings

Confidence

67%

Full breach record for National Association on Drug Abuse Problems →2 incidents on file

The National Association on Drug Abuse Problems, Inc (NADAP) notified the NH Attorney General of a data security incident affecting 7 New Hampshire residents. On January 10, 2026, NADAP identified suspicious activity and determined an unknown actor gained unauthorized access to its network, accessing files containing protected health information, names, Social Security numbers, and Medicaid Client Identification Numbers. NADAP engaged cybersecurity experts, secured its network, and notified regulators including HHS and the FBI. Affected individuals were offered 24 months of credit monitoring and fraud assistance.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 26 weeks / 185 days

Jan 10, 2026

Discovered

Jul 14, 2026

Filed

vs. sector median

+14 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Nebraska State AGbd_e257239933695c292026-07-14Verified
Vermont State AGbd_173e5a5ba35f35782026-07-15 · +1dCandidate

Name: National Association on Drug Abuse Problems
norm: national association on drug abuse problems

Name: National Association on Drug Abuse Problems
norm: national association on drug abuse problems
Industry: Healthcarellm

Discovered: Jan 10, 2026
Materiality determined: —
Notification sent: Jul 14, 2026
Affected individuals: 7state-resident count only
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the U.S. Department of Health and Human ServicesNotified the New York State Department of StateNotified the New York State Division of State PoliceNotified the Office of the New York State Attorney GeneralNotified the FBI

During the incident: Identified suspicious activity within our network
Took steps to secure its environment
Launched an investigation
Engaged independent cybersecurity experts to assist with the process
Worked expeditiously with our NYC program partners to identify all impacted individuals
Published substitute notice about the incident on our website
Reported it to the media
Sent direct notifications to individuals on a rolling basis
Set up a toll-free call center to answer questions
Notified the U.S. Department of Health and Human Services
Notified the New York State Department of State
Notified the New York State Division of State Police
Notified the Office of the New York State Attorney General
Notified our partner agencies
Notified the FBI
Changes made: Implemented additional measures to enhance network security
Enforcing stronger password requirements
Implementing conditional access policies
Continues to review policies and procedures
Offering complimentary 24-months credit monitoring services
Offering proactive fraud assistance
Providing a $1 million identity fraud loss reimbursement policy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(185 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Nebraska State AGJul 14 · first

New Hampshire State AGJul 14 · first · this page

Vermont State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/national-association-drug-abuse-problems-20260714.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 14, 2026
Raw hash: f53a386ba4934132a9471acbf127cc396b760ee2e884994d2c87e7a533c565b4

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNational Association on Drug Abuse Problems

Victim entityNational Association on Drug Abuse Problems

Incidentdiscovered Jan 10, 2026

Stated responseIdentified suspicious activity within our network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov