Lee University leeuniversity.edu Lee University data breach: what happened and what to do
Lee University in Tennessee found a cyber incident on March 22, 2024 and notified about 136,928 people in 2025. Names, Social Security numbers, government ID numbers, financial account information and medical information may have been exposed.
View all 13,115 breaches- Breach date
- 9 Mar 2024
- Made public
- 26 Mar 2025
- Affected
- 136,928
- Data exposed
- Names, Social security numbers, Government issued IDs, Financial account information, Medical information
- Last updated
What happened
Lee University, in Cleveland, Tennessee, found a potential security incident on March 22, 2024 and contained it with outside help. Classes weren't disrupted. Its notice says the incident affected local systems through a third-party software vulnerability, and that some university data may have been downloaded.
The university's review finished in March 2025, when it learned that personal information was in the data set involved. Notification letters went out in 2025. A filing with the Maryland Attorney General puts the number of people at about 136,928.
What was exposed
Depending on the person, the information may include names, Social Security numbers, driver's license or other government ID numbers, financial account information and medical information.
What it means for you
A Social Security number plus a name is what a criminal needs to open credit in your name, and it doesn't expire. Government ID numbers and financial account details add to the risk of account takeover and tax fraud. Because the notices went out more than a year after the incident, the data may already be circulating, so a credit freeze is worth doing even if you haven't seen anything suspicious.
The company's response
Lee University contained the incident and notified affected people and regulators. Later, a class action over the breach was settled with a $1.75 million fund, and the university denied wrongdoing.
What to do if you were in it
- 1
Freeze your credit
A freeze at Equifax, Experian and TransUnion stops anyone opening new credit in your name. It's free, takes a few minutes per bureau and you can lift it when you need to borrow.
- 2
Take the free monitoring if you were offered it
If Lee University sent you a letter with an enrollment code, use it before the deadline. It adds alerts on top of a freeze, it doesn't replace one.
- 3
Read your statements and explanations of benefits
Look for accounts, loans, claims or tax filings you don't recognize, and report them to the lender, insurer or the IRS right away.
- 4
Expect phishing that mentions the breach
Scammers pose as Lee University or as a credit monitoring service. Don't click links in unexpected texts or emails, and call the number on the letter or the official website instead.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan shows where your email address and phone number have appeared in known breaches and tells you what to do next.
Frequently asked
Was I affected?
Lee University mailed letters to affected people in 2025. If you were a student, employee or applicant around 2024 and didn't get one, contact the university.
What was exposed?
Possibly names, Social Security numbers, driver's license or other government ID numbers, financial account information and medical information, depending on the person.
Is there a settlement?
Yes. Reporting says Lee University agreed to a $1.75 million settlement fund in a class action over the breach, and denied wrongdoing.
Should I change my password?
The notice doesn't say passwords were involved. The bigger risk is identity theft, so freeze your credit.
Sources
- comparitech.com/news/lee-university-notifies-137k-people-of-data-breach-that-compromised-ssns-credit-cards-and-medical-info
- teiss.co.uk/news/lee-university-reaches-175m-settlement-over-2024-cyber-attack-17857
- newschannel9.com/news/local/lee-university-in-bradley-county-affected-by-potential-security-incident-in-late-march
- oag.ca.gov/privacy/databreach/list
- atg.wa.gov/data-breach-notifications
Something wrong or out of date? Tell us and we'll re-check it.
