Clop Ransomware Gang Steals Data of 3.5 Million University of Phoenix Students and Staff

**Clop Ransomware Gang Steals Data of 3.5 Million from University of Phoenix** The Clop ransomware gang has stolen the personal and financial data of nearly **3.5 million** individuals—including current and former students, staff, and suppliers—after breaching the **University of Phoenix (UoPX)** network in **August 2025**. The attack was part of a broader extortion campaign exploiting a **zero-day vulnerability (CVE-2025-61882)** in **Oracle E-Business Suite (EBS)**, a financial application used by the university. UoPX, a private for-profit institution based in **Phoenix, Arizona**, detected the breach on **November 21** after Clop listed the university on its data leak site. The stolen data includes **names, contact details, dates of birth, Social Security numbers, and bank account information**. In early December, the university publicly disclosed the incident and filed an **8-K report with the U.S. Securities and Exchange Commission (SEC)**. On **Monday**, UoPX confirmed in notification letters filed with **Maine’s Attorney General** that **3,489,274 individuals** were affected. The university is offering **free identity protection services**, including credit monitoring, dark web surveillance, and a **$1 million fraud reimbursement policy**. While UoPX has not officially attributed the attack, the tactics align with Clop’s recent campaign targeting **Oracle EBS vulnerabilities**. Other U.S. universities, including **Harvard and the University of Pennsylvania**, have also reported similar breaches linked to the same exploit. Clop has a history of high-profile data theft operations, previously targeting **GoAnywhere MFT, Accellion FTA, MOVEit Transfer, Cleo, and Gladinet CentreStack**. The U.S. Department of State has offered a **$10 million reward** for information connecting the gang’s activities to a foreign government. In a separate wave of attacks since **late October**, multiple universities—including **Harvard, Princeton, and the University of Pennsylvania**—have also fallen victim to **voice phishing (vishing) attacks**, compromising systems tied to development and alumni activities.