University of Phoenix phoenix.edu University of Phoenix data breach: what happened and what to do
Attackers exploited a flaw in Oracle E-Business Suite and accessed University of Phoenix systems between August 13 and 22, 2025. The university reported 3,489,274 people affected. Exposed data includes names, dates of birth, Social Security numbers, and bank account and routing numbers.
View all 13,115 breaches- Breach date
- 13 Aug 2025
- Affected
- 3,489,274
- Data exposed
- Names, Dates of birth, Social security numbers, Bank account numbers
- Last updated
What happened
The University of Phoenix says an unauthorized party got into its systems by exploiting a previously unknown vulnerability in Oracle E-Business Suite, the business software many large organizations use for finance and HR. Reporting puts the access window at August 13 to 22, 2025.
The university says it learned of the problem on November 21, 2025 and confirmed unauthorized access on November 24. It filed with the California and Maine Attorney Generals on December 21 and began mailing notices the next day. The count reported is 3,489,274 people. That covers current and former students, employees, faculty and suppliers. State filings show smaller numbers because each counts only its own residents: Maine, for example, listed 9,131.
The university hasn't attributed the attack to anyone.
What was exposed
According to reporting on the notice:
- Names
- Dates of birth
- Social Security numbers
- Bank account and routing numbers
If you were a student, employee or vendor, your letter says which of these apply.
What that lets criminals do
This is a combination that matters. A name, date of birth and Social Security number are what lenders and tax agencies use to confirm who you are, so they're enough to try opening credit or filing a fraudulent tax return in your name. Bank account and routing numbers add a second risk: someone can attempt unauthorized debits, or use the details to make a phishing call sound credible ("we're calling about your account ending in...").
Because the access happened in 2025 and notices went out in December, some of this data has been in someone else's hands for over a year. Don't wait for a sign of misuse before acting.
What the company did
The university's sample letter, filed with the Iowa Attorney General, offers 12 months of credit monitoring, identity theft recovery help, dark web monitoring and a $1 million fraud reimbursement policy. Enrolling requires a redemption code printed in your letter.
What to expect next
Notices began on December 22, 2025, but the access happened months earlier, so you may have been exposed for longer than the letter date suggests. If you attended years ago or worked for the university, you can still be in the group: the count includes former students and employees, and suppliers too.
Keep your letter and its redemption code. The monitoring offer is for 12 months, so put the deadline in your calendar. After that, the credit freeze keeps working at no cost, and you only lift it when you apply for credit yourself. Check your credit reports for free at AnnualCreditReport.com every few months for the next year.
If you're not sure whether the letter is real, don't use links in it. Search for the university's own notice page and compare.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze is free and stops anyone opening new credit in your name. Do it at Equifax, Experian and TransUnion (each one separately). You can lift it temporarily when you apply for a loan.
- 2
Enroll in the monitoring offered in your letter
The university offers 12 months of credit monitoring and identity theft recovery help. You need the redemption code from your notice.
- 3
Tell your bank and watch your account
Your bank account and routing numbers were included. Ask your bank about extra fraud monitoring or a new account number, and check for debits you didn't authorize.
- 4
Get an IRS Identity Protection PIN
With your Social Security number exposed, a PIN from the IRS stops someone filing a return in your name. You can request one on irs.gov.
- 5
Be skeptical of calls and emails about the university or your account
Don't act on links or phone numbers in unexpected messages. Contact your bank or the university through details you look up yourself.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, with what to do next. It can't take data out of a breach, so the alert is what lets you act early.
Frequently asked
Was I affected by the University of Phoenix breach?
If you got a notice letter, yes. The university reported 3,489,274 people, including current and former students, employees, faculty and suppliers.
What was exposed?
Names, dates of birth, Social Security numbers, and bank account and routing numbers, according to reporting on the notice.
Is there a settlement?
No source reviewed reports a settlement.
Should I change my password?
Passwords weren't listed as exposed. Your priorities are the credit freeze and watching your bank account.
Sources
- oag.ca.gov/privacy/databreach/list
- atg.wa.gov/data-breach-notifications
- iowaattorneygeneral.gov/media/cms/12212025_University_of_Phoenix_8C629C6F163BE.pdf
- cyberinsider.com/breach-at-university-of-phoenix-exposed-data-of-3-5-million-people/
- bankinfosecurity.net/university-phoenix-data-breach-35m-individuals-affected-a-30378
Something wrong or out of date? Tell us and we'll re-check it.
