NFI North Data Breach Exposes Sensitive Information of Nearly 50,000 Individuals
On September 6, 2025, NFI North a nonprofit providing mental and behavioral health services across Maine and New Hampshire detected a network security incident involving unauthorized access to its systems. The organization, which serves thousands annually through community-based programs, engaged third-party forensic specialists to investigate the breach.
The investigation confirmed that sensitive data was exfiltrated, including names, Social Security numbers, personally identifiable information (PII), and protected health information (PHI). On November 13, 2025, NFI North began notifying affected individuals via written notice.
The breach impacted approximately 49,540 people across Maine, Massachusetts, New Hampshire, and Vermont. Class action law firm Shamis & Gentile P.A. is now investigating potential compensation claims for those affected.
Source: https://www.claimdepot.com/investigations/nfi-north-data-breach-2026
National Foundation for India cybersecurity rating report: https://www.rankiteo.com/company/nfiind
"id": "NFI1788514973",
"linkid": "nfiind",
"type": "Breach",
"date": "9/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '49,540',
'industry': 'Mental and Behavioral Health Services',
'location': 'Maine, New Hampshire',
'name': 'NFI North',
'type': 'Nonprofit'}],
'customer_advisories': 'Written notice to affected individuals',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '49,540',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Personally identifiable '
'information (PII), Protected '
'health information (PHI), Social '
'Security numbers, Names'},
'date_detected': '2025-09-06',
'date_publicly_disclosed': '2025-11-13',
'description': 'NFI North, a nonprofit providing mental and behavioral health '
'services across Maine and New Hampshire, detected a network '
'security incident involving unauthorized access to its '
'systems. The breach resulted in the exfiltration of sensitive '
'data, including names, Social Security numbers, personally '
'identifiable information (PII), and protected health '
'information (PHI).',
'impact': {'data_compromised': 'Names, Social Security numbers, personally '
'identifiable information (PII), protected '
'health information (PHI)',
'identity_theft_risk': 'High',
'legal_liabilities': 'Potential compensation claims under '
'investigation by Shamis & Gentile P.A.'},
'investigation_status': 'Ongoing',
'references': [{'source': 'Cyber Incident Description'}],
'regulatory_compliance': {'legal_actions': 'Class action investigation by '
'Shamis & Gentile P.A.'},
'response': {'communication_strategy': 'Written notice to affected '
'individuals',
'third_party_assistance': 'Engaged third-party forensic '
'specialists'},
'title': 'NFI North Data Breach Exposes Sensitive Information of Nearly '
'50,000 Individuals',
'type': 'Data Breach'}