Impact Melanoma Inc., a national nonprofit focused on melanoma prevention and awareness, has disclosed that unauthorized access to employee email accounts may have exposed a person’s name and Social Security number.
Impact Melanoma’s Data Breach Investigation
Impact Melanoma Inc., a national nonprofit organization that works to reduce melanoma through awareness, early detection, and support for patients and families, has notified regulators of a data security incident involving its email accounts. The notice was submitted to the New Hampshire Attorney General’s Consumer Protection Bureau by outside counsel acting for the organization. It describes unauthorized access to a limited number of email accounts and a long review that followed before anyone could say whose information was involved.
According to the filing, Impact Melanoma became aware of the unauthorized access on or about May 26, 2026. The organization says it contained the activity right away and opened an investigation with the help of outside cybersecurity professionals. A letter prepared for the affected person describes the event in plain terms: an unknown individual accessed two employee inboxes. Impact Melanoma has not publicly explained how the person gained entry to those accounts, whether through phishing, a reused password, or some other method, and it has not identified who was responsible.
The investigation did not end once the activity was contained. Email accounts can hold years of messages and attachments, so working out whose information sat inside the affected inboxes required what the notice calls an extensive manual document review. That review wrapped up on or about September 10, 2026, when Impact Melanoma confirmed that personal information tied to one individual may have been accessed or acquired before May 26, 2026. Written notice to that person was scheduled to go out on or about September 21, 2026, roughly four months after the unauthorized access was first detected.
The only count Impact Melanoma has made public so far comes from the New Hampshire filing, which reports one affected New Hampshire resident. The filing does not say how many people in other states may have received notices, and the organization has not published a national total. The figure of one should therefore be read as the number tied to that single state notice, not as a confirmed total for the whole incident. Other regulators may have received separate filings that are not yet reflected in public records.
The organization states that it has no evidence of identity theft or financial fraud connected to the incident. That statement appears in most breach notices and deserves some context. A lack of known misuse on the day a notice is written does not mean the information is safe, because stolen personal data can be held for months or traded before anyone uses it. For a Social Security number the risk does not expire, since the number rarely changes during a person’s lifetime.
Impact Melanoma is offering the affected individual 12 months of complimentary credit monitoring through IDX, along with identity protection services, and it says it will advise the person to review financial account statements regularly for irregular activity. The letter also points to the three nationwide credit reporting agencies and the Federal Trade Commission as resources. The organization adds that it continues to evaluate and adjust its practices to improve the security and privacy of the personal information it maintains.
Nonprofits are not immune to incidents like this one. Charitable organizations often keep donor, volunteer, employee, and vendor records in email systems that were never designed to serve as secure archives, and a compromised mailbox can quietly expose tax forms, onboarding paperwork, and correspondence that include Social Security numbers. Delays between an intrusion and a notice are also typical of email compromise cases, because every message and file in the affected accounts has to be reviewed before the organization can say who is affected. That is a general pattern across the industry and not a confirmed detail about how Impact Melanoma handled its own review.
If you have any connection to Impact Melanoma as an employee, donor, volunteer, or vendor and you receive a notice, read it carefully and use the monitoring offer before the enrollment deadline printed in the letter. Because the filing names a Social Security number among the information that may have been exposed, the steps described in the sections below deserve particular attention.
When Did This Breach Occur?
Impact Melanoma says it became aware of the unauthorized access to its email accounts on or about May 26, 2026, and that the personal information involved may have been accessed or acquired before that date. The organization has not said when the unauthorized activity began, so the start of the exposure window is unknown.
After a forensic investigation and a manual review of the documents in the affected accounts, the organization confirmed on or about September 10, 2026 that one individual’s personal information was involved. Written notice to that individual was planned for on or about September 21, 2026, and the notice to the New Hampshire Attorney General followed in the same window.
What Information Was Breached?
The notice states that the information that may have been exposed includes the affected individual’s full name and Social Security number. Impact Melanoma has not said that any financial account numbers, medical information, or other data types were involved, and none should be assumed.
A name paired with a Social Security number is the combination most often used to open fraudulent accounts, file false tax returns, or attempt other forms of identity theft, which is why even a single affected person warrants careful follow-up.
What You Can Do
If you receive a notice from Impact Melanoma, enroll in the complimentary credit monitoring offered through IDX and keep a copy of the letter. Review your bank, credit card, and insurance statements for activity you do not recognize, and check your credit reports for accounts or inquiries you did not authorize. You are entitled to a free report from each nationwide credit bureau every 12 months at annualcreditreport.com.
Consider placing a one-year fraud alert on your credit files, or a security freeze, both of which are free. A freeze blocks most new credit applications until you lift it. Be cautious with unexpected emails, calls, or texts that mention Impact Melanoma, your Social Security number, or your credit, and report any identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Impact Melanoma
Individuals whose Social Security numbers are exposed through an organization’s email system may have legal options, particularly where the organization failed to use reasonable safeguards or took a long time to give notice. Data breach claims are often brought on behalf of everyone affected, which can reduce the burden on any one person.
Whether a claim exists depends on the facts of your situation, including what information was involved and how you were affected. A lawyer can review your notice and explain what rights you may have.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
