DisclosureLens
Social EngineeringEducationEducationPhishingStolen CredentialsCustomer Data InvolvedTargetedPIIIdentity (basic)CredentialsLowContained

National University of Natural Medicine

bd_bb50dd7193281f83 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 29, 2025

Filed

Nov 26, 2025

To disclose

17 weeks

Affected

12state residents only

Linked

8 filings

Confidence

65%
Full breach record for National University of Natural Medicine

National University of Natural Medicine (NUNM) notified affected individuals of a cybersecurity incident where an unauthorized individual accessed an employee email account. Access occurred between July 22 and July 29, 2025. The incident was discovered on July 29, 2025. NUNM engaged external cybersecurity professionals and Kroll for identity monitoring. Personal information, including names and potentially credentials, was involved. Notification was sent on November 26, 2025.

Incident timeline

undetected · 7 days
discovery → filing · 17 weeks / 120 days

Jul 22, 2025

Begins

Jul 29, 2025

Discovered

Nov 26, 2025

Filed

vs. sector median

+9 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Show 3 more filingsup to 5d gap

Filing propagation · 8 filings · 8 states

View merged incident ↗
Indiana State AGNov 26 · first
Maine State AGNov 26 · first
Massachusetts State AGNov 26 · first
Vermont State AGNov 26 · first
Oregon State AGNov 26 · first
Nebraska State AGNov 26 · first
Montana State AGNov 26 · first · this page

Pattern: first filing Nov 26 (IN), last Dec 1 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.