The California Office of the Attorney General disclosed a data breach affecting ITHAKA on March 31, 2014. Unauthorized actors accessed approximately 800 MyJSTOR accounts, exposing sensitive but non-financial user data. Compromised information included usernames, passwords, email addresses, primary areas of study, academic positions/statuses, and institutional affiliations. While the breach did not involve financial records or highly sensitive personal identifiers (e.g., Social Security numbers or payment details), the exposure of academic credentials and institutional ties posed risks of credential stuffing, targeted phishing, or reputational harm for affected users—primarily researchers, students, and faculty. The incident highlighted vulnerabilities in ITHAKA’s authentication systems, though no evidence suggested the stolen data was misused for fraud or broader cyberattacks. The breach was contained without escalation to systemic disruptions or financial losses for the organization or its users.