University of Phoenix Breach Hits 3.5 Million

The University of Phoenix has confirmed a significant data breach that compromised the personal information of nearly 3.5 million current and former students, employees, faculty members, and suppliers. The incident, linked to a cyberattack exploiting a vulnerability in Oracle's E-Business Suite software, occurred between August 13 and 22, 2025, with the university detecting unauthorized access on November 21, 2025.

Investigators determined that hackers used a zero-day flaw in the Oracle E-Business Suite, an enterprise system for managing financial, human resources, and supply chain operations, to infiltrate the university's network. The breach was part of a broader campaign attributed to the Cl0p ransomware group, which targeted more than 100 organizations worldwide, including several U.S. universities such as Harvard, the University of Pennsylvania, and Dartmouth College. Cl0p, known for data extortion rather than encryption, claimed responsibility by listing the University of Phoenix on its dark web site on November 20, 2025, prompting the institution's probe.

The stolen data included full names, contact information, dates of birth, Social Security numbers, and bank account...