Monroe University Discloses Massive Data Breach Affecting Over 320,000 Individuals Monroe University, a Bronx-based institution, recently revealed a significant data breach after an unauthorized third party accessed its systems between December 9 and 23, 2024. The attacker exfiltrated files containing sensitive information, which the university later confirmed included personally identifiable information (PII) and protected health information (PHI). The compromised data encompassed a wide range of personal details, such as names, dates of birth, Social Security numbers, driver’s license and passport numbers, government IDs, medical records, health insurance information, email credentials, financial account details, and student data. The university completed its review of the affected files on September 30, 2025, and publicly disclosed the breach on January 13, 2026, after reporting it to the Maine Attorney General. The breach impacted 320,973 individuals across the U.S., including 85 Maine residents. In response, Monroe University engaged cybersecurity experts to investigate and mitigate further risks. Written notifications to affected individuals began on January 2, 2026, with the university offering a one-year complimentary credit monitoring service through Cyberscout (a TransUnion company). The service includes credit file monitoring at Experian, Equifax, and TransUnion, along with fraud assistance. Affected individuals have 90 days from notification to enroll.

Monroe University Data Breach Exposes Personal and Health Information of Over 320,000 Individuals Monroe University has disclosed a significant data security incident affecting approximately 320,973 individuals, whose personal and health information may have been compromised. The breach occurred between December 9 and December 23, 2024, when an unauthorized party accessed the university’s computer systems. The intrusion was detected on December 23, 2024, prompting immediate containment efforts and an internal investigation. By September 30, 2025, the investigation confirmed that the attacker exfiltrated sensitive files containing a range of data, including names, dates of birth, Social Security numbers, driver’s license and passport numbers, government IDs, medical records, health insurance details, email credentials, financial account information, and student data. Affected individuals began receiving mailed notifications on January 2, 2026. While the university has stated there is no evidence of data misuse, the breach underscores the ongoing risks to large-scale repositories of personal information. The incident remains under review as authorities assess its full impact.

Monroe University Confirms Massive Data Breach Affecting 320,000 Individuals Monroe University disclosed a significant data breach in which threat actors stole sensitive personal, financial, and health information belonging to over 320,000 individuals. The attack occurred in December 2024, with attackers maintaining access to the university’s systems for two weeks from December 9 to December 23. The breach was confirmed in September 2025 after a review of the stolen files revealed compromised data, including names, dates of birth, Social Security numbers, driver’s license and passport details, medical records, health insurance information, financial account data, and student records. The university began notifying affected individuals on January 2, 2025, urging them to monitor their credit reports and account activity for signs of fraud. As part of the response, Monroe University offered one year of free credit monitoring through Cyberscout. This is not the first cybersecurity incident for the institution, which was previously targeted in a 2019 ransomware attack when it operated as Monroe College. At the time, attackers demanded 170 bitcoins (approximately $2 million) for decryption. The breach at Monroe University is part of a broader trend of cyberattacks targeting U.S. higher education institutions. In recent months, the University of Hawaii’s Cancer Center reported a ransomware attack in August 2025, while Baker University disclosed a 2024 breach affecting over 53,000 individuals. Additionally, Harvard, Princeton, and the University of Pennsylvania fell victim to voice phishing attacks starting in October 2024, resulting in the theft of donor, staff, student, and alumni data. The Clop ransomware gang also exploited vulnerabilities in Oracle E-Business Suite platforms at Harvard and the University of Pennsylvania, stealing personal and financial information.

Monroe University Data Breach Exposes Sensitive Information of Hundreds of Thousands Between December 9 and 23, 2024, an unauthorized party accessed Monroe University’s systems and exfiltrated files containing personal data. The breach was discovered on September 30, 2025, when the university confirmed the compromised files included sensitive information for an unspecified number of individuals. The exposed data encompassed a wide range of personal details, including names, birth dates, Social Security numbers, driver’s license and passport numbers, medical and health insurance records, financial account information, and email credentials. Student records were also among the affected data. Impacted individuals were notified via mail on January 2, 2026 over a year after the breach occurred and more than three months after the university confirmed the data’s sensitivity. While Monroe University stated there was no evidence of identity theft or fraud stemming from the incident, it did not offer credit monitoring services to affected parties, according to The HIPAA Journal. The breach has since sparked legal action. A class action lawsuit, filed by plaintiff Rosemary Maysonet, alleges the university failed to implement adequate security measures, violating federal and state data protection laws. The complaint further criticizes the delayed notification, arguing that the university did not act promptly after identifying the breach. The lawsuit seeks reimbursement for out-of-pocket expenses, compensatory damages, credit monitoring services, attorney fees, and mandatory improvements to the university’s cybersecurity infrastructure.

Monroe College was hit by a ransomware attack by hackers who demanded approximately $2 million in bitcoin. The school’s computer programs were hacked by a group that got in through ransomware and halted the system. The hackers sent a message demanding that the university, which has a location on Jerome Avenue in Kingsbridge Heights, send 170 bitcoin the equivalent of $2 million in order to have its system restored. The organization was unable to access a lot of their systems at that moment.