Monroe University: Monroe University Data Breach Affects 320k Exposing Social Security Numbers

Monroe University Discloses Massive Data Breach Affecting Over 320,000 Individuals

Monroe University, a Bronx-based institution, recently revealed a significant data breach after an unauthorized third party accessed its systems between December 9 and 23, 2024. The attacker exfiltrated files containing sensitive information, which the university later confirmed included personally identifiable information (PII) and protected health information (PHI).

The compromised data encompassed a wide range of personal details, such as names, dates of birth, Social Security numbers, driver’s license and passport numbers, government IDs, medical records, health insurance information, email credentials, financial account details, and student data. The university completed its review of the affected files on September 30, 2025, and publicly disclosed the breach on January 13, 2026, after reporting it to the Maine Attorney General.

The breach impacted 320,973 individuals across the U.S., including 85 Maine residents. In response, Monroe University engaged cybersecurity experts to investigate and mitigate further risks. Written notifications to affected individuals began on January 2, 2026, with the university offering a one-year complimentary credit monitoring service through Cyberscout (a TransUnion company). The service includes credit file monitoring at Experian, Equifax, and TransUnion, along with fraud assistance. Affected individuals have 90 days from notification to enroll.

Source: https://www.claimdepot.com/data-breach/monroe-college-2026

Monroe University TPRM report: https://www.rankiteo.com/company/monroe-university

"id": "mon1768409103",
"linkid": "monroe-university",
"type": "Breach",
"date": "1/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '320,973 individuals',
                        'industry': 'Education',
                        'location': 'Bronx, New York, USA',
                        'name': 'Monroe University',
                        'type': 'Educational Institution'}],
 'attack_vector': 'Unauthorized system access',
 'customer_advisories': 'Written notifications mailed to affected individuals '
                        'on 2026-01-02 with recommendations for vigilance and '
                        'credit monitoring enrollment.',
 'data_breach': {'data_exfiltration': 'Yes',
                 'number_of_records_exposed': '320,973',
                 'personally_identifiable_information': ['Names',
                                                         'Dates of birth',
                                                         'Social Security '
                                                         'numbers',
                                                         'Driver’s license '
                                                         'numbers',
                                                         'Passport numbers',
                                                         'Government '
                                                         'identification '
                                                         'numbers',
                                                         'Medical information',
                                                         'Health insurance '
                                                         'information',
                                                         'Electronic account '
                                                         'or email usernames '
                                                         'and passwords',
                                                         'Financial account '
                                                         'information',
                                                         'Student data'],
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)',
                                              'Protected Health Information '
                                              '(PHI)']},
 'date_detected': '2024-12-23',
 'date_publicly_disclosed': '2026-01-13',
 'description': 'Monroe University disclosed a data breach following an '
                'unauthorized third-party hack of their systems, resulting in '
                'the exposure of personally identifiable information (PII) and '
                'protected health information (PHI).',
 'impact': {'data_compromised': 'PII and PHI',
            'identity_theft_risk': 'High',
            'payment_information_risk': 'High',
            'systems_affected': 'University computer systems'},
 'investigation_status': 'Completed (review finished on 2025-09-30)',
 'recommendations': 'Affected individuals are encouraged to enroll in credit '
                    'monitoring services, review account statements, monitor '
                    'credit reports, and report suspicious activity.',
 'references': [{'source': 'Monroe University Website'},
                {'source': 'Maine Attorney General Disclosure'}],
 'regulatory_compliance': {'regulatory_notifications': ['Maine Attorney '
                                                        'General']},
 'response': {'communication_strategy': 'Written notifications mailed to '
                                        'affected individuals',
              'containment_measures': 'Investigation and risk containment',
              'incident_response_plan_activated': 'Yes',
              'remediation_measures': 'Credit monitoring services offered',
              'third_party_assistance': 'Cybersecurity experts'},
 'title': 'Monroe University Data Breach',
 'type': 'Data Breach'}