---
title: "American Board of Preventive Medicine data incident"
description: "The American Board of Preventive Medicine disclosed unauthorized network access and personal-information risk from March 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-16"
canonical_url: "https://www.ally.security/incidents/american-board-preventive-medicine-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/american-board-preventive-medicine-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/american-board-preventive-medicine-data-incident-2026/stix.json"
---

# American Board of Preventive Medicine data incident

The American Board of Preventive Medicine confirmed unauthorized access to its network. Its investigation found that files containing personal information were accessed or acquired around March 8–10, 2026.

Last modified Oct 16, 2026 · 1 source

## Summary

- **Environment:** Medical certification board network
- **Operational impact:** No operational outage established in the reviewed notice
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

The [American Board of Preventive Medicine](https://www.theabpm.org/) confirmed unauthorized access to its network. Its investigation found that files containing personal information were accessed or acquired around March 8–10, 2026. [1](#source-1)

## Impact

Around September 24, ABPM determined through forensic investigation and manual document review that the affected files contained personal information. [1](#source-1)

The [public letter](https://oag.ca.gov/system/files/ABPM_Letter_A_-_Adult_CM%2839926523.1%29_v2__Static_Proof_R2%2840256146.1%29_Redacted_40290666v1_0.pdf) identifies names but omits other recipient-specific fields. It gives no affected-person count. September 24 is the data-review finding, not a confirmed initial detection date.

## Timeline

### October 16, 2026 — Briefing updated

This briefing was last reviewed and updated on October 16, 2026.

## Threat Group & Attack Vector

The reviewed notice does not identify an entry method or responsible group.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

ABPM secured its internal environment and investigated with external cybersecurity specialists. It offered credit and identity monitoring and said it had no knowledge of misuse resulting from the incident at notice time. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/american-board-preventive-medicine-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### American Board of Preventive Medicine data security notice

official · American Board of Preventive Medicine

<https://oag.ca.gov/system/files/ABPM_Letter_A_-_Adult_CM%2839926523.1%29_v2__Static_Proof_R2%2840256146.1%29_Redacted_40290666v1_0.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Affected Organization · 100% confidence · current**  
   American Board of Preventive Medicine data incident: American Board of Preventive Medicine
2. **Resulted In · 100% confidence · current**  
   American Board of Preventive Medicine data incident: Around September 24, ABPM determined through forensic investigation and manual document review that the affected files contained personal information.
3. **Resulted In · 100% confidence · current**  
   American Board of Preventive Medicine data incident: The American Board of Preventive Medicine confirmed unauthorized access to its network. Its investigation found that files containing personal information were accessed or acquired around March 8–10, 2026.
4. **Resulted In · 100% confidence · current**  
   American Board of Preventive Medicine data incident: ABPM secured its internal environment and investigated with external cybersecurity specialists. It offered credit and identity monitoring and said it had no knowledge of misuse resulting from the incident at notice time.

</details>