Princeton University princeton.edu Princeton University data breach 2022: what happened and what to do
Princeton University told state attorneys general that Social Security numbers were inadvertently disclosed in an incident dating to April 28, 2020. The university found it in June 2022, began notifying people in July 2022 and offered identity monitoring.
View all 13,177 breaches- Breach date
- 28 Apr 2020
- Made public
- 11 Jul 2022
- Data exposed
- Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Princeton University reported a data breach to state attorneys general in 2022. The filings date the incident to April 28, 2020 and describe it as an inadvertent disclosure of personal information, including Social Security numbers. The university discovered it in June 2022, and written notices to affected people went out on July 11, 2022.
What was exposed
The filings name Social Security numbers. A Social Security number is the key item for identity theft: with a name and date of birth it can be used to apply for credit or file a tax return in someone else's name. The filings don't name other data types.
With a Social Security number, a name and a date of birth, someone can open credit or file a tax return in your name, and the number rarely changes, so the risk can last for years. The same details also fuel phishing that claims to come from a bank or a government office.
The university's response
Princeton offered affected people identity monitoring for two years at its own expense, according to the Maine filing. The filings give slightly different discovery dates and totals across versions, so this page states no single count.
A different, later incident
This is not the November 2025 incident involving Princeton's advancement database. Princeton has said Social Security numbers were not part of that one.
Sources checked: maine.gov, mass.gov, consumer.ftc.gov
Last verified against the official page:
What to do if you were in it
- 1
Use the identity monitoring if you were offered it
If you got a notice letter, it explains how to enroll. The FTC recommends taking free credit monitoring when it's offered.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and blocks new accounts being opened with your Social Security number. Place it with Equifax, Experian and TransUnion separately. The FTC explains how.
- 3
Watch your statements and credit reports
Check your free credit reports and look for accounts or charges you don't recognize. If you find misuse, report it at identitytheft.gov.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details appear.
Official filings
- California Attorney General , filed 8 Jul 2022
Timeline
-
The breach happened
-
Reported to the California Attorney General
-
The company made it public
Frequently asked
Was I affected by the Princeton University breach?
If you were affected, Princeton sent you a written notice in July 2022. If you think you should have received one and didn't, contact the university using the details on its public notice.
What was exposed?
The state filings name Social Security numbers.
Is this the same as the 2025 Princeton breach?
No. The 2025 incident involved an advancement database and is separate.
Should I freeze my credit?
If your Social Security number was exposed, yes. The FTC says a freeze is free and lasts until you lift it.
Sources
- maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0722b27c-2c7c-46f9-8202-e2b437f0ec69.shtml
- mass.gov/doc/assigned-data-breach-number-27842-princeton-university/download
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
