Syracuse University data breach: what happened and what to do

An unauthorized party got into a Syracuse University employee's email account in late September 2020. Names and Social Security numbers of about 9,800 students, alumni and applicants were in the account. The university began notifying people in early 2021.

View all 13,177 breaches

Breach date: 24 Sept 2020
Made public: 5 Feb 2021
Data exposed: Names, Social security numbers
Last updated: 27 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Between September 24 and 28, 2020, an unauthorized party had access to the email account of a Syracuse University employee. The university's notice to the Maine Attorney General says it could not determine whether the person actually opened any emails or attachments. A review of the account found names and Social Security numbers. Reporting on the incident put the number of people affected at about 9,800 students, alumni and applicants.

The university started notifying people in early 2021, and the breach appeared on the California Attorney General's list on February 5, 2021. Critics, including a student who later brought a class action, objected to the months-long gap between the incident and the notices. Bloomberg Law reported in 2023 that the university settled that case.

Sources checked: oag.ca.gov, campussecuritytoday.com, news.bloomberglaw.com

Last verified against the official page: 27 Oct 2026

How we research this Report an error

What the exposure means

A name together with a Social Security number is the core of identity theft. It can be used to apply for credit, file a fake tax return or open accounts in someone's name, sometimes long after the breach. The notice doesn't say how the account was accessed, so the page doesn't guess.

The university's response

The university offered one year of free credit monitoring and identity theft protection through Experian to people whose Social Security numbers may have been accessed. If you got a letter, the enrollment instructions and deadline are in it.

What to do if you were in it

1

Freeze your credit

Place a free credit freeze at Equifax, Experian and TransUnion, as the FTC advises when a Social Security number may be exposed. Then check your reports at annualcreditreport.com for accounts you don't recognize.
2

Take the free credit monitoring if you were offered it

The FTC recommends accepting monitoring a company offers after a breach. It alerts you to new activity but doesn't block it, so keep the freeze in place.
3

Report misuse

If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
4

Be wary of messages that mention the breach

Scammers write to people named in a breach. Don't click links or call numbers in an unexpected email, text or letter; go to the organization's own website or phone number instead.
5

Check whether your email or phone is in this and other breaches

Run a free Serus scan. It checks breach databases for your email, phone and other details and alerts you when they show up in a new leak.

Official filings

California Attorney General , filed 5 Feb 2021

Timeline

24 Sept 2020
The breach happened
5 Feb 2021
The company made it public
5 Feb 2021
Reported to the California Attorney General

Frequently asked

Was I affected by the Syracuse University breach?

Only people whose information was in the email account were notified by letter. If you got a letter from Syracuse University in 2021, you were included. If you didn't, there is nothing to say you were.

What was exposed?

Names and Social Security numbers, according to the university's notice to regulators.

Is there a settlement?

Bloomberg Law reported in 2023 that Syracuse University settled a proposed class action over the incident. Check the court's notice for current terms.