DisclosureLens
Social EngineeringEducationEducationPhishingTargetedPIIIdentity (basic)LowContained

National University of Natural Medicine

bd_99008cb8d07aec6b · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 29, 2025

Filed

Nov 26, 2025

To disclose

17 weeks

Affected

Not disclosed

Linked

8 filings

Confidence

66%
Full breach record for National University of Natural Medicine

National University of Natural Medicine notified consumers of a cybersecurity incident where an unauthorized individual accessed an employee email account between July 22 and July 29, 2025. The incident likely involved personal information. The university secured the account, engaged external forensic investigators, and is offering complimentary identity monitoring services through Kroll.

Vermont clock VT AG >45 bday17 weeks discovery → filing
unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 7 days
discovery → filing · 17 weeks / 120 days

Jul 22, 2025

Begins

Jul 29, 2025

Discovered

Nov 7, 2025

Scope determined

Nov 26, 2025

Filed

vs. sector median

+9 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Show 3 more filingsup to 5d gap

Filing propagation · 8 filings · 8 states

View merged incident ↗
Indiana State AGNov 26 · first
Maine State AGNov 26 · first
Massachusetts State AGNov 26 · first
Oregon State AGNov 26 · first
Montana State AGNov 26 · first
Nebraska State AGNov 26 · first
Vermont State AGNov 26 · first · this page

Pattern: first filing Nov 26 (IN), last Dec 1 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.