The American Board of Preventive Medicine (ABPM) has told regulators that an unauthorized actor gained access to its network and that files containing personal information were involved.
Here is what the board has disclosed so far and what you can do if you received a notice.
American Board of Preventive Medicine’s Data Breach Investigation
The American Board of Preventive Medicine (ABPM) certifies physicians in preventive medicine specialties and says it was established in 1948. Its notice letter, filed with the California Attorney General and listed in that office’s public breach database on October 13, 2026, describes a cybersecurity incident in which an unauthorized actor gained access to the board’s network environment. The letter is on ABPM’s Chicago, Illinois letterhead.
According to the template notice, the board worked to secure its internal environment once it learned of the issue, and it began an investigation with outside cybersecurity professionals who handle incidents of this kind. After what the letter calls an extensive forensic investigation and a complex manual document review, ABPM says it discovered on or about September 24, 2026 that certain electronic files contained personal information. Those files were accessed or acquired between on or about March 8, 2026 and March 10, 2026.
The board states that it has no knowledge that anyone’s information has been or will be misused as a direct result of the incident. It is offering complimentary credit and identity monitoring through IDX, along with identity theft recovery services. The filed copy leaves the length of the service blank, though it gives a deadline to enroll of January 6, 2027. The letter also describes general precautionary steps, such as placing a fraud alert or a security freeze on credit files and requesting a free credit report, and it adds information about protecting medication information.
The timeline deserves a close look. The access happened over a window of about three days in March 2026, yet the board says it did not determine until late September 2026 that personal information was in the affected files. That is a gap of roughly six months between the access and the discovery that personal data was involved. Manual document review is slow, because analysts must open and read files to find names and other identifiers and then match them to individuals. For the people involved, though, that means months may have passed without any warning.
The filed letter is a template, and the sentence that lists the types of information involved is cut off in the public copy. It begins with the recipient’s full name, and the rest of the list does not appear. This page does not guess at the missing categories. The board has also not published a count of affected individuals in the material reviewed for this page.
A professional certification body can hold a range of records about the people it certifies and the people who apply, from contact details to exam and application files. Which of those groups was affected here is not disclosed, and the public record does not say whether the files concerned physicians, applicants, staff, or others. If you have applied for or held certification through ABPM, your own letter is the best guide to what applies to you.
Incidents at organizations that keep records on licensed professionals are a reminder that the harm from exposed identifiers is not limited to consumers. A professional can face identity theft, fraudulent credit applications and impersonation that targets their standing in the field, so people in this position have good reason to take the offered protections seriously.
The mention of medication information in the letter is a reminder that some notices include guidance on protecting prescription and health details. It should not be read as a confirmation that any health information was involved in this incident, since the letter’s list of data types is not visible in the public copy.
If you received a letter from the board, keep it with the envelope, write down the date it arrived, and read it for the specific data elements and the length of the monitoring service. Enroll before the January 6, 2027 deadline if you want the service, since the letter notes the monitoring must be activated to be effective.
When Did This Breach Occur?
The board says the files involved were accessed or acquired between on or about March 8, 2026 and March 10, 2026. It says it discovered on or about September 24, 2026 that those files contained personal information.
The notice was posted to the California Attorney General’s breach listing on October 13, 2026. The deadline to enroll in the monitoring service, as stated in the letter, is January 6, 2027.
What Information Was Breached?
The public copy of the notice is cut off where the data types would be listed. It confirms only that the information involved includes the recipient’s full name, and the remaining categories are not visible.
Your own letter should list the data elements that apply to you. Keep it for your records.
What You Can Do
If you received a notice related to American Board of Preventive Medicine or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the free IDX monitoring before the January 6, 2027 deadline listed in the letter, and activate it, since the letter notes that the monitoring must be activated to be effective.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against American Board of Preventive Medicine
If your personal information was exposed in this incident, you may have legal options. Organizations are expected to protect the information they collect, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
