National Alliance for Direct Support Professionals Data Breach

National Alliance for Direct Support Professionals (NADSP), a national nonprofit organization based in Albany, New York, has notified state regulators and affected individuals of a cybersecurity incident involving unauthorized access to its email environment. The exposed information may have included Social Security numbers, driver’s license numbers, and financial account information. Organizations that maintain sensitive personal data have a responsibility to protect it from unauthorized access.

National Alliance for Direct Support Professionals’s Data Breach Investigation

According to a notice filed with the New Hampshire Attorney General’s Office, NADSP detected unauthorized access to its email environment on January 13, 2026. Upon discovering the incident, NADSP immediately isolated the affected environment and worked with its internal IT staff and outside cybersecurity experts to secure and remediate the compromised systems. NADSP also engaged a third-party cybersecurity firm to conduct a comprehensive forensic investigation into the nature and scope of the intrusion, which determined that an unauthorized third party had potentially viewed and/or downloaded data stored on certain NADSP systems.

Following those findings, NADSP conducted an extensive review of the affected files to identify the specific individuals impacted and the categories of information involved. That review was not completed until July 7, 2026, nearly six months after the initial discovery of the incident, at which point NADSP finalized its list of individuals to notify. Extended timelines like this between discovery and notification are common in email-based intrusions, since determining exactly whose data was contained in a compromised mailbox, and precisely what type of information appeared in each affected message, is a labor-intensive process that can take many months to complete accurately.

Nonprofit organizations and professional associations like NADSP often hold sensitive data on members, staff, and program participants, including Social Security numbers and financial account details, making them attractive targets for cybercriminals despite typically having smaller IT security budgets than larger corporations. The combination of Social Security numbers, driver’s license numbers, and financial account information exposed here creates meaningful risk of both identity theft and direct financial fraud for anyone whose data was compromised.

When Did This Breach Occur?

NADSP discovered unauthorized access to its email environment on January 13, 2026. The organization finalized its list of affected individuals on July 7, 2026, and notification letters were mailed on or about July 23, 2026.

What Information Was Breached?

NADSP’s notice indicates that the type of information that may have been compromised includes Social Security numbers, driver’s license numbers, and financial account information. NADSP’s New Hampshire filing identified one New Hampshire resident as potentially affected by this incident; the total number of individuals affected nationwide has not been publicly disclosed.

What You Can Do

NADSP is offering affected individuals 12 months of complimentary credit monitoring and identity theft protection services through Cyberscout, a TransUnion company. If you received a notification letter from NADSP, consider taking the following steps:

• Enroll in the complimentary credit monitoring services within the deadline listed in your notification letter
• Place a fraud alert or credit freeze with Equifax, Experian, and TransUnion
• Monitor your financial accounts and statements for unauthorized activity
• Request and review a free copy of your credit report from annualcreditreport.com
• Report any suspected identity theft to the FTC and your state Attorney General

File a Data Breach Lawsuit Against National Alliance for Direct Support Professionals

If your personal information was exposed in the NADSP data breach, you may have legal options available to you. Organizations entrusted with sensitive personal and financial information are expected to maintain reasonable safeguards to protect that data, and victims of a breach may be entitled to compensation.

Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.