Kaplan North America Data Breach Exposes Sensitive Information of Over 220,000 Individuals
Kaplan North America LLC, a major educational services provider based in Fort Lauderdale, Florida, confirmed a data breach affecting thousands of individuals across the U.S. and Canada. The company, a division of Kaplan Inc. and owned by Graham Holdings Co., disclosed that an unauthorized actor accessed its network between October 30 and November 18, 2025, compromising files containing sensitive personal data.
The breach was discovered during an investigation concluded on February 21, 2026. Kaplan responded by securing its systems, engaging external cybersecurity experts, and notifying law enforcement. Affected individuals began receiving written notifications on March 17, 2026.
The exposed data includes names, Social Security numbers, and driver’s license numbers, putting victims at risk of identity theft and fraud. The breach impacted at least 221,408 individuals, with notable concentrations in Texas (173,676), South Carolina (26,612), Maine (19,075), and Rhode Island (2,045).
Class action law firm Shamis & Gentile P.A. is investigating the incident and potential legal claims for affected individuals. Those impacted may be eligible for compensation related to identity monitoring, financial losses, or other damages.
Source: https://www.claimdepot.com/investigations/kaplan-data-breach-2026
Kaplan cybersecurity rating report: https://www.rankiteo.com/company/kaplan
Graham Holdings Company cybersecurity rating report: https://www.rankiteo.com/company/graham-holdings-company
"id": "KAPGRA1773858919",
"linkid": "kaplan, graham-holdings-company",
"type": "Breach",
"date": "2/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '221408',
'industry': 'Education',
'location': 'Fort Lauderdale, Florida, USA',
'name': 'Kaplan North America LLC',
'type': 'Educational services provider'}],
'customer_advisories': 'Written notifications sent to affected individuals on '
'March 17, 2026',
'data_breach': {'number_of_records_exposed': '221408',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Social Security numbers',
'Driver’s license numbers']},
'date_detected': '2026-02-21',
'date_publicly_disclosed': '2026-03-17',
'description': 'Kaplan North America LLC, a major educational services '
'provider, confirmed a data breach affecting thousands of '
'individuals across the U.S. and Canada. An unauthorized actor '
'accessed its network between October 30 and November 18, '
'2025, compromising files containing sensitive personal data. '
'The breach was discovered during an investigation concluded '
'on February 21, 2026, and affected individuals began '
'receiving notifications on March 17, 2026.',
'impact': {'data_compromised': 'Sensitive personal data including names, '
'Social Security numbers, and driver’s license '
'numbers',
'identity_theft_risk': 'High',
'legal_liabilities': 'Potential legal claims for affected '
'individuals'},
'investigation_status': 'Concluded',
'references': [{'source': 'Class action law firm Shamis & Gentile P.A.'}],
'regulatory_compliance': {'legal_actions': 'Class action investigation by '
'Shamis & Gentile P.A.'},
'response': {'communication_strategy': 'Written notifications to affected '
'individuals',
'containment_measures': 'Securing systems',
'incident_response_plan_activated': 'Yes',
'law_enforcement_notified': 'Yes',
'third_party_assistance': 'External cybersecurity experts'},
'threat_actor': 'Unauthorized actor',
'title': 'Kaplan North America Data Breach Exposes Sensitive Information of '
'Over 220,000 Individuals',
'type': 'Data Breach'}