Nonprofit mental health provider NFI North has disclosed a network intrusion that potentially exposed the sensitive personal and health data of nearly 50,000 individuals across the United States.
According to a filing with the New Hampshire Attorney General, an unauthorized third party gained access to the organization's computer network, impacting a total of 49,540 individuals. A supplemental filing identified 2,813 of those impacted as New Hampshire residents.
The organization stated that the unauthorized party stole files which may contain names, Social Security numbers, other personally identifiable information, and protected health information.
NFI North reported that it detected the network security incident on or about September 6, 2025. Following the detection, the provider engaged third-party forensic specialists to secure the network environment and investigate the extent of the unauthorized activity. A comprehensive review was subsequently conducted to determine which files and personal information may have been involved.
In response to the incident, NFI North notified the FBI and rebuilt the affected systems. The organization is also offering 12 months of free credit monitoring, credit report, and credit score services through Cyberscout.
At the time of the disclosure, NFI North stated that it had received no evidence of identity theft or data misuse resulting from the breach.
