NADAP listed on genesis ransomware leak site

• Ransomware group: genesis
• Country: United States
• Sector: Healthcare
• Announcement date: March 7, 2026

The genesis ransomware group has listed the United States-based non-profit healthcare organization NADAP on its leak site. The threat actor claims to have successfully targeted the organization, marking a significant potential data breach within the healthcare sector.

The claims made by the genesis group

According to the announcement made on March 7, 2026, the genesis group claims to have exfiltrated 2 TB of data belonging to NADAP. The group alleges that the attack took place on March 6, 2026. In their communication, the threat actors state that the security measures implemented by the organization were insufficient to prevent the intrusion. Furthermore, the group claims that their ransom demands were not met by the organization.

As a consequence of the failed negotiations, the announcement indicates that the stolen data may be published on the dark web. This follows a common pattern observed in modern cyberattacks known as double extortion. In such scenarios, threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage, threatening to leak it publicly if the ransom is not paid.

The scope of the alleged data exfiltration

The information listed in the leak site announcement suggests a massive compromise of sensitive and regulated data. The group claims to have accessed a wide variety of files that could impact numerous individuals and the organization's internal operations. The alleged breach includes the following types of data:

• Medical records
• Personal data
• Financial data
• HR records
• Medicaid billing data
• Criminal justice records

The group specifically claims to have obtained SQL databases containing over 400,000 personal records, along with medical databases and HIPAA-compliant health records. Additionally, the leaked information reportedly includes Medicaid billing data, criminal justice-linked records, financial data, and internal emails. Human resources files, such as Social Security Numbers (SSNs) and payroll information, are also cited as part of the compromise, alongside vendor contracts.

About NADAP

NADAP is a non-profit organization based in New York. The organization provides support in health and social services, aiming to facilitate individuals' access to the healthcare system.

Potential impact and security considerations

The alleged breach of NADAP could have significant consequences for both the organization and the individuals whose information was targeted. The exposure of sensitive health data, specifically information protected under HIPAA and 42 CFR Part 2, could lead to legal sanctions and administrative fines for the organization. Furthermore, the leak of such data may negatively impact the organization's operational processes and its relationships with third parties.

For the patients and employees of the organization, the theft of personal and medical information increases the risk of identity theft and fraud. Such risks are common when highly sensitive identifiers, such as SSNs and payroll details, are exposed. While public information regarding the genesis group remains limited, it is possible that targeted phishing could be used as a secondary attack vector following such a breach.

In the healthcare sector, organizations often face heightened risks due to the high value of medical records on the dark web. To mitigate these risks, security professionals generally recommend robust defensive measures. These include implementing multi-factor authentication, maintaining strict access controls, and conducting regular security awareness training to defend against phishing. Additionally, organizations often rely on continuous monitoring and encryption to protect sensitive data at rest and in transit to prevent unauthorized exfiltration.