A student walks on the campus of Dartmouth College in Hanover, New Hampshire, on March 5, 2024. Photo by Robert F. Bukaty/AP This story by Clare Shanahan was first published in the Valley News on Dec. 1, 2025. HANOVER — More than 40,000 people in Vermont and New Hampshire may have been impacted by a data breach in a system used by Dartmouth College. Last week, Dartmouth started mailing letters to the people whose personal information was included in data stolen over three days in early August. During that time, an “unauthorized actor” was able to access Dartmouth College files and take data, including “one or more” files that had personal information such as names, Social Security numbers and financial account information, according to reports Dartmouth filed with the offices of the attorneys general of New Hampshire and Vermont last week. The breach was part of a widespread attack on the Oracle eBusiness Suite, a platform Dartmouth and many other companies use to manage operations. A ransomware group has been taking credit for the attack and it has identified more than 100 companies impacted by the breach, according to reporting from SecurityWeek. “This incident was not the result of any ‘phishing’ attack on a member of the Dartmouth community or any other action or inaction on Dartmouth’s part,” college spokesperson Jana Barnello said. After Oracle reported the security breach in early October, Dartmouth launched an investigation “as quickly as possible” to identify t

Dartmouth College, located just across the Connecticut River from Vermont in Hanover, New Hampshire, has notified more than 35,000 people that their personal information was stolen in a cyberattack this past summer. The breach affects current and former employees, students, and alumni—including many Vermonters who have worked at, attended, or have other ties to the Ivy League institution. Here’s what happened, what information was compromised, and what steps affected individuals should take to protect themselves. What Happened Between August 9 and August 12, 2025, hackers exploited a previously unknown security flaw—known as a “zero-day vulnerability”—in Oracle E-Business Suite software that Dartmouth uses to manage payroll, human resources, and financial operations. According to the college’s official notification, the attackers gained unauthorized access to the system and downloaded files containing sensitive personal data. The vulnerability, tracked as CVE-2025-61882, was not publicly known at the time of the attack, meaning Dartmouth had no way to patch the flaw before hackers exploited it. Cybersecurity researchers at CrowdStrike have attributed the attack to a cybercriminal group known as Cl0p, which has targeted numerous organizations worldwide using similar methods. Who Is Affected The breach impacts an estimated 35,000 or more individuals, according to The Record. This includes employees, former employees, students, alumni, and others whose information was stor