Notice of a Data Security Incident

CHAPEL HILL, N.C.--(BUSINESS WIRE)--UNC Hospitals and the University of North Carolina at Chapel Hill School of Medicine (SOM) announced today that they are notifying certain individuals about a recent security incident involving a SOM faculty member’s email account.

On July 24, 2025, the University discovered that an unauthorized individual had gained access to a SOM faculty member’s email account after the faculty member inadvertently clicked on a malicious phishing link. The account was secured within 15 hours. An investigation, supported by independent cybersecurity experts, confirmed the incident was isolated and limited to this one account. There is no indication that other University, SOM, or UNC Hospitals’ email accounts or patient information systems were accessed.

On September 19, 2025, UNC Hospitals and the University mailed letters to individuals whose information may have been involved. A dedicated call center has also been established to answer questions at [phone] (Monday–Friday 8:00 a.m.–11:00 p.m. and Saturday 9:00 a.m.–6:00 p.m. ET).

Although there is no evidence that any personal information has been misused, UNC Hospitals and the University are offering complimentary credit monitoring services to impacted individuals whose Social Security number, driver’s license number, financial account details, or health insurance information may have been at risk. Impacted individuals are strongly encouraged to review their credit reports, consider placing a fraud alert or security freeze to help prevent identity theft, and closely review billing statements from healthcare providers for any unfamiliar charges.

The University and UNC Hospitals regret any concern this incident may cause. The SOM faculty member involved has received additional training on phishing awareness, and the University is reviewing policies, procedures, and technical safeguards to further reduce the risk of similar incidents in the future.