2026 NAS Recovery Solutions — insider download; up to 7,000 clients (SUD)
Data compromised
Limited fields per notice: first and last names, dates of birth, and telephone numbers; as an SUD provider, treatment context could be inferred
Technical writeup
Verified insider healthcare breach — HIPAA Journal (July 23, 2026). NAS Recovery Solutions (Lakewood, CO) learned May 13, 2026 that workforce members downloaded client data without authorization. Up to 7,000 current and former clients may be affected. Copied data limited to names, DOBs, and phone numbers; no indication other fields were taken. Company reviewed access controls, provided additional HIPAA training, and took undisclosed corrective action against involved staff.
Root cause
Insider breach: certain workforce members downloaded client data without authorization (learned May 13, 2026); not a hacking incident per company notice