Trocaire College Cyberattack Exposes Sensitive Data of Over 23,000 Individuals A cyberattack on Trocaire College in Buffalo, New York, detected on March 13, 2025, compromised the personal information of more than 23,000 current and former students and employees, including names and Social Security numbers. The college confirmed the breach in a notice filed with the Maine Attorney General but did not notify affected individuals until January 16, 2026 nearly 10 months later. Trocaire College stated it was unaware of any misuse of the stolen data but urged impacted individuals to monitor their accounts and credit reports. The institution also offered one year of identity theft protection and credit monitoring, along with a $1 million insurance reimbursement policy, to those whose Social Security numbers were exposed. In a prepared statement, President Bassam Deeb emphasized the college’s commitment to enhancing network security with the help of cybersecurity experts. The delayed notification has sparked three class-action lawsuits, including one filed by former employee Challis Graham, who reported an increase in spam calls and messages following the attack. The lawsuits allege Trocaire failed to implement adequate cybersecurity measures and neglected to promptly inform victims, allowing stolen data to potentially circulate on the dark web. Higher education institutions have become prime targets for cybercriminals, with ransomware attacks on schools and colleges rising 114% between 2020 and 2022, according to a Bank of America report. In 2025 alone, 130 confirmed and unconfirmed ransomware attacks on educational institutions were reported in the first two quarters. Trocaire is not the first local institution to face such an attack. In 2021, Buffalo Public Schools canceled classes after a ransomware incident, later allocating $9 million to bolster its cybersecurity defenses. The incident underscores the growing threat to educational institutions, which store vast amounts of sensitive data attractive to hackers.