University of Phoenix Hit by Massive Data Breach Affecting Millions In November 2025, the University of Phoenix disclosed a significant data breach impacting over 3.4 million current and former students and staff. The breach, attributed to the CL0P ransomware group, exploited a vulnerability in the university’s Oracle E-Business Suite software between August 13 and August 22, 2025, leading to the exfiltration of sensitive personal data. Exposed information included names, dates of birth, Social Security numbers, and financial details such as bank account and routing numbers. The university reported the incident to the California and Maine Attorney Generals’ offices on December 21, 2025, and began notifying affected individuals the following day. Among those impacted were 9,131 Maine residents. The breach has prompted legal action, with Shamis & Gentile P.A., a class-action law firm specializing in data breach cases, investigating potential compensation for victims. The university has offered free IDX identity theft protection services to those affected. The University of Phoenix, a private for-profit institution based in Phoenix, Arizona, serves working adults through online degree programs in fields like business, healthcare, and information systems. The incident underscores the growing threat of ransomware attacks targeting educational institutions.