The American Association of Colleges of Osteopathic Medicine (AACOM) recently disclosed a data breach that may have exposed the protected health information (PHI) of almost 68,000 individuals.
On September 26, 2024, AACOM reported suspicious activity in an employee’s email account. Soon after, an internal investigation later confirmed that an unauthorized third party may have accessed and exfiltrated sensitive personal information. The organization completed its data review on March 31, 2025, identifying the potentially compromised information.
On April 8, 2025, AACOM began mailing breach notification letters to affected individuals. Impacted data may include names and Social Security numbers. Additionally, the organization is offering complimentary credit and cyber monitoring services to affected individuals.
The AACOM breach notification letter states, “Although we have no evidence of the misuse of any information as a result of this incident, we are also offering you complimentary identity protection services through IDX, a data breach and recovery services expert. IDX identity protection services include: 12 months/24 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed ID theft recovery services.”
The letter further read, “With this protection, IDX will help you resolve issues if your information is compromised. You can enroll in the IDX services by calling 1-877-798-4138 or by going to https://app.idx.us/account-creation/protect and using the enrollment code provided above. Please note the deadline to enroll is July 8, 2025.”
According to Paubox’s 2025 Healthcare Email Security Report:
Ultimately, the AACOM breach shows how over-reliance on default security settings, poor adoption of authentication protocols, and limited employee awareness put healthcare and educational organizations at constant risk.
Healthcare organizations must use a HIPAA compliant email solution that uses automatic encryption, inbound threat protection, and monitoring to mitigate the risk of potential data breaches.
Related: HIPAA Compliant Email: The Definitive Guide (2025 Update)
A breach occurs when an unauthorized party gains access to, uses, or discloses protected health information (PHI) without permission. Examples of breaches include hacking, losing a device containing PHI, or sharing information with unauthorized individuals.
If individuals suspect their data has been compromised, they must monitor their accounts for suspicious activity and report any unauthorized transactions immediately.
No, under U.S. law, consumers are entitled to a free credit report annually from each of the three major credit reporting bureaus, Equifax, Experian, and TransUnion. So, placing a fraud alert or credit freeze does not incur any costs.