Villa Maria College Data Breach Exposes Sensitive Student and Staff Information
Villa Maria College, a private Catholic institution in Buffalo, New York, disclosed a data breach involving unauthorized access to its network between August 7 and 14, 2024. The college detected unusual activity on August 12, 2024, prompting an investigation that revealed unauthorized access to specific network folders.
After a thorough review, the college confirmed on March 17, 2026, that the breach exposed sensitive personal data, including names, Social Security numbers, dates of birth, payment card details, financial account numbers, driver’s license or state ID numbers, and tax identification numbers belonging to students and staff.
Notification letters were sent to affected individuals on May 18, 2026, the same day the breach was reported to the Massachusetts Office of Consumer Affairs and Business Regulation and publicly posted on the college’s website.
In response, Villa Maria College is providing 12 months of free credit monitoring and identity protection services through Cyberscout, with enrollment required within 90 days of notification. A dedicated call center (1-800-405-6108) has been established for inquiries, operating Monday through Friday from 8 a.m. to 8 p.m. ET. The college can also be contacted directly at 716-961-1838 or via mail at 240 Pine Ridge Rd., Buffalo, NY 14225.
Source: https://www.claimdepot.com/data-breach/villa-maria-college-2026
Villa Maria Academy cybersecurity rating report: https://www.rankiteo.com/company/villa-maria-academy
"id": "VIL1779288165",
"linkid": "villa-maria-academy",
"type": "Breach",
"date": "8/2024",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Students and staff',
'industry': 'Education',
'location': 'Buffalo, New York, USA',
'name': 'Villa Maria College',
'type': 'Educational Institution'}],
'attack_vector': 'Unauthorized Network Access',
'customer_advisories': '12 months of free credit monitoring and identity '
'protection services through Cyberscout, enrollment '
'required within 90 days of notification. Dedicated '
'call center (1-800-405-6108) for inquiries.',
'data_breach': {'personally_identifiable_information': ['Names',
'Social Security '
'numbers',
'Dates of birth',
'Driver’s license or '
'state ID numbers'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personally Identifiable '
'Information',
'Payment Card Details',
'Financial Account Numbers',
'Tax Identification Numbers']},
'date_detected': '2024-08-12',
'date_publicly_disclosed': '2026-05-18',
'description': 'Villa Maria College disclosed a data breach involving '
'unauthorized access to its network between August 7 and 14, '
'2024. The breach exposed sensitive personal data, including '
'names, Social Security numbers, dates of birth, payment card '
'details, financial account numbers, driver’s license or state '
'ID numbers, and tax identification numbers belonging to '
'students and staff.',
'impact': {'data_compromised': 'Sensitive personal data including names, '
'Social Security numbers, dates of birth, '
'payment card details, financial account '
'numbers, driver’s license or state ID '
'numbers, and tax identification numbers',
'identity_theft_risk': 'High',
'payment_information_risk': 'High',
'systems_affected': 'Network folders'},
'investigation_status': 'Completed',
'references': [{'date_accessed': '2026-05-18',
'source': 'Villa Maria College Website'}],
'regulatory_compliance': {'regulatory_notifications': ['Massachusetts Office '
'of Consumer Affairs '
'and Business '
'Regulation']},
'response': {'communication_strategy': 'Notification letters sent to affected '
'individuals, public disclosure on '
'college website, dedicated call '
'center established',
'third_party_assistance': 'Cyberscout (credit monitoring and '
'identity protection services)'},
'title': 'Villa Maria College Data Breach Exposes Sensitive Student and Staff '
'Information',
'type': 'Data Breach'}