Baker University Suffers Major Data Breach, Exposing Sensitive Personal and Health Information Baker University, a private liberal arts institution in Baldwin City, Kansas, disclosed a significant data breach that compromised sensitive information belonging to students, staff, and affiliated individuals. The incident was detected in December 2024 after suspicious activity triggered a network outage, prompting an immediate investigation. Between December 2 and December 19, 2024, unauthorized actors accessed and exfiltrated files containing a broad range of personal data. The exposed information included names, dates of birth, driver’s license numbers, financial account details, health insurance records, medical information, passport numbers, Social Security numbers, student IDs, and tax identification numbers—affecting both personally identifiable information (PII) and protected health information (PHI). While the total number of impacted individuals remains undisclosed, regulatory filings confirm that at least 66 Massachusetts residents were affected. The breach was reported to the Attorney Generals’ offices in Massachusetts and California on December 19, 2025, and a public notice was posted on the university’s website. In response, Baker University secured its systems, engaged cybersecurity experts, and implemented enhanced security measures. The incident was reported to law enforcement, and affected individuals are being offered complimentary credit monitoring and identity restoration services through IDX for 24 months, with an enrollment deadline of March 19, 2026. A dedicated helpline has been established for inquiries.