National University of Natural Medicine (NUNM) Data Breach Exposes SSNs

On or about July 29, 2025, the National University of Natural Medicine (NUNM) identified unauthorized access to one of its employee email accounts. According to the notice, the cybersecurity incident exposed personally identifiable information (PII).

An investigation, with help from external cybersecurity professionals, determined that an unknown individual had gained access to this account between July 22 and July 29, 2025. The breach was discovered on Nov. 7, 2025, after a thorough review of the impacted emails.

The potentially compromised emails contained personal information, including Social Security numbers. While the exact types of additional information exposed were not detailed, the presence of Social Security numbers makes this breach especially significant, as such data can be used for identity theft and financial fraud.

So far, the breach has impacted at least 15 individuals in Maine and 29 in Massachusetts. The university notified the Maine Attorney General's office and affected individuals in writing on Nov. 26, 2025.

National University of Natural Medicine's response

Immediately after learning of the incident, NUNM secured the compromised email account and launched an investigation with experienced cybersecurity professionals. Upon confirming the scope of the breach, the university conducted a detailed review of the affected emails to determine whose information was involved.

As a precaution, NUNM is offering complimentary identity monitoring services through Kroll to all affected individuals.

If you receive notification from NUNM or your provider about this breach, you may want to:

• Sign up for the free Kroll identity theft protection services, offered by NUNM.
• Monitor your credit reports and financial accounts for any unusual activity.
• Be alert for phishing emails or phone calls that may use your exposed information.
• Consider placing a fraud alert or credit freeze with major credit bureaus.

NUNM has set up a dedicated call center to answer questions about this cybersecurity event, the details of which can be found in the notice letter mailed to impacted individuals.