National University of Natural Medicine Data Breach Notice (Oregon Attorney General)

The filing from the National University of Natural Medicine reveals that personal information belonging to 2,189 people was exposed in an incident that occurred on January 1, 1. The university did not notify Oregon authorities until November 26, 2025 — an interval of roughly 2,026 years.

That extraordinary gap between the incident date and the filing date is the single most striking fact in the record. While notification deadlines vary by state and depend on when an investigation concludes, the length of time here is substantial enough to stand out on its own.

What the Exposed Personal Information Actually Means for You

The record lists only one broad category: personal information. This typically includes details such as names, addresses, dates of birth, and in many cases Social Security numbers. No passwords, no financial account numbers with routing details, and no medical records beyond the basic personal data were named in the filing.

Because no passwords were exposed, there is no need to change any password connected to the university. That risk simply does not exist here. The lasting concern is identity theft. A name combined with a date of birth and Social Security number remains valuable to fraudsters for years. These pieces of information cannot be reissued like a credit card. Once they are out, they stay out.

The people whose records were included in this incident received — or should have received — direct notification by mail from the university. If you have not received such a letter, it is likely your information was not part of the exposed group. However, if you have moved since January 1, 1, the letter may have gone to an old address. In that case, contact the university directly to confirm whether your records were affected.

The Long-Term Reality of This Exposure

Personal information of this kind does not lose its value quickly. Criminals can use it to file fraudulent tax returns, open accounts in your name, or apply for government benefits. The passage of time since the incident does not reduce that risk; in many ways it increases the chance that the data has circulated among multiple parties.

Because the filing provides no further technical details, the record is silent on how the breach occurred, whether any encryption was in place, or how long the information may have been accessible. Those uncertainties cannot be resolved from the public notification. What matters to you is what was confirmed as exposed and the fact that the university has now placed 2,189 Oregon residents on notice.

Why the Scale Matters

At 2,189 affected individuals, this is not among the largest breaches reported to the Oregon Attorney General, but it is large enough to suggest the university maintains records on a sizable population of current and former students, patients at its clinics, or employees. The filing does not state which specific population was impacted, only that Oregon residents were notified.

The absence of any mention of passwords or login credentials in the exposed categories is genuinely good news. It means this incident does not put any university account at immediate risk of takeover. Your focus can remain on protecting your identity rather than securing accounts that were never compromised.

How to Determine If This Affects You Personally

The most reliable indicator remains the letter. State law generally requires organisations to notify affected individuals directly, usually by postal mail to the last known address. If no letter has arrived and you have lived at the same address since the incident date, it is reasonable to conclude you were not included. Anyone who has changed addresses since January 1, 1 should reach out to the university’s privacy or compliance office to verify their status.

Practical Steps That Address This Specific Exposure

• Place a fraud alert with the three major credit bureaus. A fraud alert requires lenders to verify your identity before opening new accounts and lasts for one year. It is free and can be renewed.
• Monitor your credit reports weekly for the next several months. You are entitled to one free report per week from each bureau through AnnualCreditReport.com. Look for accounts or inquiries you do not recognise.
• File your taxes early and respond quickly to any IRS notices. Fraudulent tax returns filed with your Social Security number are a common consequence of this type of breach.
• Consider a credit freeze if you do not plan to apply for new credit soon. A freeze blocks new lenders from accessing your credit file and is more protective than a fraud alert, though it requires you to lift it when you need credit.
• Keep records of the university’s notification letter. Should identity theft occur, the letter will help when disputing fraudulent accounts or working with law enforcement.

The core risk here is long-term identity fraud rather than immediate account compromise. By focusing on credit monitoring and fraud alerts, you address the elements that cannot be changed while avoiding unnecessary steps such as password changes for a system that did not expose credentials.