Tulane University Data Breach Exposes Employee and Student Worker Information Tulane University has confirmed a data breach affecting multiple employees and student workers, exposing sensitive personal and financial information. The breach, disclosed in letters sent on April 2, revealed that names, Social Security numbers, and direct deposit banking details stored in Oracle’s E-Business Suite (EBS) were compromised. The university first detected the breach on March 12, after unauthorized access occurred on August 10, 2025, exploiting a vulnerability in Oracle EBS. The attack may be linked to a flaw first exploited on August 9, 2025, which cybersecurity firms Google Threat Intelligence and Mandiant attribute to the Cl0p ransomware group, a Russian-speaking extortion operation. On November 19, 2025, Cl0p publicly claimed responsibility for the attack and threatened to release the stolen files, according to dark web monitoring site DeXpose. Tulane had been using Oracle EBS until March 20, 2025, when it transitioned to Oracle Cloud. Following the breach, the university launched an investigation, notified law enforcement, and worked with Oracle and third-party cybersecurity vendors to address the vulnerability. This incident follows two prior Oracle breaches in 2025: a January breach exposing over 140,000 Oracle Cloud users and six million sensitive records, and an April breach where hackers stole client login credentials. Tulane has expressed regret over the incident and stated that corrective measures have been implemented to prevent future occurrences. The total number of affected individuals remains unclear.

Tulane University Data Breach Exposes Sensitive Personal Information On March 12, 2026, Tulane University disclosed a cybersecurity incident involving unauthorized access to sensitive files, first detected on August 10, 2025. The breach stemmed from a zero-day vulnerability in Oracle’s E-Business Suite, a platform used by the university to store HR data. Attackers exploited the flaw to access system files before Tulane implemented security patches and launched an investigation with law enforcement. The exposed data includes names, Social Security numbers, direct deposit details, and banking information, putting affected individuals at risk of identity theft and fraud. Those who received a breach notification from Tulane may be impacted. National class action firm Edelson Lechtzin LLP is investigating potential legal claims on behalf of affected individuals, offering free case evaluations to assess rights and remedies. The firm specializes in data privacy litigation and has previously handled cases involving financial fraud, wage theft, and consumer protection violations. Tulane University, a private institution in New Orleans, is known for its academic, research, and medical programs. The incident highlights ongoing risks associated with third-party software vulnerabilities in higher education.