The Association for Neurologically Impaired Brain Injured Children Inc. (ANIBIC), a Queens, New York nonprofit that has served people with special needs for more than 50 years, has confirmed a data security incident in which an unauthorized party held access to its computer network for roughly twelve months. According to reporting from claimdepot.com, the breach was reported to the U.S. Department of Health and Human Services on July 17, 2026 and affected 1,918 individuals. The exposed data set is close to worst case for the population involved: names, contact details, Social Security numbers, dates of birth, health insurance information, and clinical detail including medications and diagnoses, belonging to program members who depend on ANIBIC for residential care, day habilitation, service coordination, and vocational training.
A note on sourcing before anything else. The two accounts of this incident available to us, [S1] and [S3], are both published by claimdepot.com, and both are OTHER tier. They agree with each other on every material fact, but they are not independent confirmation of one another. ANIBIC's own website notice and the HHS Office for Civil Rights breach portal entry are the authoritative records here, and readers who need certainty on the victim count should go to those. Everything below carries that caveat.
What Happened
ANIBIC discovered suspicious activity on its network and engaged third party forensic experts to investigate. That investigation concluded that an unauthorized party had access to ANIBIC's systems between March 7, 2025 and March 8, 2026, a dwell time of one year and one day. On May 18, 2026, the organization learned that files containing program member information had been involved. Notification to HHS followed on July 17, 2026, with a website notice and individual letters accompanying it.
The timeline is the story. Roughly twelve months of undetected access, followed by another seventy days from the point ANIBIC learned files were involved to the regulatory filing. The second interval sits inside the HIPAA sixty day window only if the clock started later than May 18; on the face of the reported dates it does not. HIPAA's breach notification rule requires notice without unreasonable delay and no later than sixty days from discovery, and the point at which "discovery" occurs is exactly the question that regulators have been pressing on in comparable cases. ComplianceHub's analysis of the Medical Computer Business Services breach, in which 1,261,464 patients were notified nine months after a September 2025 intrusion, walks through the same fault line: organizations tend to treat completion of the forensic review as the trigger, when the rule ties the clock to when the breach is known or reasonably should have been known.
No threat actor has claimed this intrusion publicly, and neither available source names ransomware, extortion, or a leak site listing. There is no reported evidence of misuse of the data at time of writing. Treat the actor as unattributed.
What Was Taken
The confirmed data elements, per the review ANIBIC conducted of the affected files:
- Names and contact information
- Social Security numbers
- Dates of birth
- Health insurance information
- Service information, including medication information and diagnostic information
Volume is reported at 1,918 individuals. Only one source gives a figure, so it is single sourced and unverified against the HHS portal. Anyone modeling exposure should confirm it directly.
This combination matters more than the headcount suggests. A name plus SSN plus date of birth is a complete synthetic identity kit with an indefinite shelf life. Layer diagnostic and medication data on top and the file becomes usable for medical identity fraud, prescription fraud, and highly credible targeted social engineering. The population makes it worse. ANIBIC's program members are individuals with neurological impairment and brain injury, many of whom rely on guardians or coordinators to manage their financial and medical affairs. They are less likely to spot fraudulent activity themselves, less likely to be monitoring credit files, and more likely to be enrolled in Medicaid, which brings its own fraud surface. Disability care nonprofits hold data on people who are structurally poor at self defense against identity crime.
ANIBIC is offering complimentary identity monitoring to program members whose Social Security numbers were involved, and has advised members to scrutinize provider statements for services they did not receive. Neither source states the duration of the monitoring offer. For comparison, Wabi Sabi Behavioral Health Center offered twelve months through Kroll in its July 2026 payroll breach, which is the current floor in this sector rather than a generous benchmark.
Why It Matters
Small healthcare and social services nonprofits are the softest large target in the US health data ecosystem. They hold the same regulated PHI as a hospital system, are bound by the same HIPAA obligations, and typically run on a fraction of the security budget, often with no dedicated security staff and an outsourced or part time IT function. A twelve month dwell time is not an anomaly in this segment. It is what happens when there is no one watching the logs.
The follow on legal exposure is already forming. Shamis & Gentile P.A. has opened a class action investigation into the ANIBIC breach, per claimdepot.com. That pattern is consistent across the sector this summer, with Federman & Sherwood investigating Wabi Sabi Behavioral Health and Dapeer Law investigating Credit First National Association. For a nonprofit operating on program funding, litigation and notification costs can be materially more damaging than the intrusion itself.
One clarification worth making because the acronym collides. "ANIB" also refers to Al Nabooda Insurance Brokers LLC, a Dubai insurance brokerage with no connection to this incident. Personnel or infrastructure associated with that firm should not be pulled into any analysis of this breach.
The Attack Technique
The initial access vector for the ANIBIC intrusion has not been disclosed. Neither available source names a vulnerability, a phishing campaign, a compromised credential, or a third party vendor. That gap should be stated rather than papered over, and nothing below should be read as attribution.
What can be said is what the current threat landscape looks like for an organization of this profile with a year long dwell time. Huntress, reporting on intrusions it worked across the first half of 2026, documented a standardized seven step playbook run by an initial access broker: pre authentication exploitation of CitrixBleed 2 (CVE-2025-5777) against internet facing NetScaler gateways, where malformed login requests leak appliance memory and yield valid session tokens. Because a hijacked live session bypasses the authentication step entirely, MFA provides no protection once the token is replayed. From there the operators escalated to SYSTEM via a registry symlink and AppMgmt privilege escalation technique, created rogue local administrator accounts, frequently named to blend in as "Citrix" admins, and established persistence using legitimate remote management tooling such as ScreenConnect and Zoho Assist. In the most advanced case Huntress observed, the chain terminated in DragonForce ransomware.
That pattern is instructive here for one reason: it produces exactly the profile ANIBIC exhibits. Access through an edge appliance, persistence through software that looks legitimate to an under monitored environment, and a long quiet period of file access before anything visible happens. Other 2026 incidents in the sources illustrate different but equally plausible routes into a small provider. Wabi Sabi Behavioral Health was compromised through stolen credentials on a third party authorized QuickBooks Online account, an access path with no perimeter to defend at all. Credit First National Association's exposure came from an insider at its payment processing vendor, United Nearshore Operations, who was allegedly memorizing customer card numbers. And as the Amicale Police et Patrimoine claim covered by Undercode News shows, small associations attached to larger recognizable institutions are actively sought out by actors looking for easy data and reputational reach.
What Organizations Should Do
- Patch and session hygiene on all edge appliances. If you run Citrix NetScaler, confirm CVE-2025-5777 is remediated and then explicitly terminate all outstanding ICA and PCoIP sessions. Patching alone does not evict an attacker who already holds a stolen session token. Extend the same discipline to every internet facing VPN, gateway, and file transfer appliance.
- Audit for rogue accounts and unauthorized RMM tooling. Enumerate local administrator accounts across the estate and look for recently created ones with plausible sounding names. Inventory every remote access agent installed, including ScreenConnect, Zoho Assist, AnyDesk, and TeamViewer, and alert on any new installation. Legitimate tools used illegitimately are the dominant persistence mechanism in this class of intrusion.
- Fix the detection gap that allows twelve month dwell times. Retain logs long enough to reconstruct an intrusion, which for most small providers means considerably longer than the default. If in house monitoring is not realistic, a managed detection service is the single highest value security spend available to an organization this size. A year of undetected access is a monitoring failure, not a prevention failure.
- Enforce least privilege on file shares holding PHI. The damage in this breach came from an attacker reading files, not from encryption. Segment clinical and member record repositories, restrict access to the roles that genuinely need it, and instrument alerting on bulk file access. Nothing else limits blast radius as directly.
- Map and contract around third party access. Wabi Sabi and CFNA were both compromised through vendors. Inventory every third party with credentials or system access, require MFA on their accounts, and ensure business associate agreements specify notification timelines that let you meet your own regulatory obligations.
- Pre plan the notification clock. Decide now, with counsel, when your organization treats a breach as "discovered" under 45 CFR 164.404 and 164.410, and build the notification workflow before you need it. The MCBS case makes clear that a defensible answer to this question is a compliance control in its own right, not a legal afterthought.
For care providers specifically, one addition: notification and monitoring enrollment must be designed for guardians and care coordinators, not just for the individual named in the record. An identity monitoring offer that a brain injured program member cannot practically enroll in is not a remedy.
Sources: ANIBC Association Data Breach Exposes SSNs and Health ... | CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware Hun... | Brain Injury Association Data Breach Lawsuit Investigation | French Police Association Targeted in Dark Web Data Leak Claim, Rai... | Wabi Sabi Behavioral Health Center LLC Data Breach – Investigated b... | Ilanchezhian K | Credit First National Association Data Breach Lawsuit (July 2026) | Nine Months to Notice: MCBS, 1.26 Million Patients, and the HIPAA C...