What Happened in the Southern California University of Health Sciences Data Breach?
Southern California University of Health Sciences, commonly known as SCUHS, has notified individuals that their personal information was exposed in a network intrusion. The university discovered unauthorized activity on its computer network in March 2026. As a result, it launched an investigation with outside cybersecurity specialists to understand what had happened.
According to the notification, the unauthorized actor viewed and copied certain files stored on the university’s network. This activity occurred over a short window in March 2026, before SCUHS detected it. Because the intrusion involved actual file access and copying, this incident goes beyond a simple network disruption.
After discovering the breach, SCUHS worked to secure its systems and restore normal operations. The university then conducted a detailed review of the affected files. This review aimed to identify exactly what information was contained in the files and which individuals were connected to that data. SCUHS also stated it would report the event to regulators as required by law.
The California Attorney General’s office received notice of this breach as part of the university’s compliance obligations. Consequently, affected individuals began receiving written notification letters describing the incident. SCUHS has said it currently has no evidence of identity theft or fraud tied to this event, though it chose to notify people out of caution.
Who was affected?
The individuals affected by this breach appear to include people connected to Southern California University of Health Sciences, such as students, patients, or other individuals whose records were stored on the university’s network. The exact number of people affected has not been publicly disclosed in the notification materials.
Because SCUHS operates health science education programs, the affected population may include current and former students, faculty, or patients who interacted with university-affiliated clinical services. The notification letter does not specify the geographic reach of those affected, though the university is based in Whittier, California. Individuals receiving letters should treat the notice as a strong indication that their data was part of the impacted files.
What Information Was Potentially Exposed?
The notification confirms that names were included in the files accessed by the unauthorized actor. Beyond names, the letter references additional data elements specific to each recipient, meaning the exact categories of exposed information can vary by individual. Because SCUHS operates within the health sciences field, sensitive categories such as health-related or identification information are a reasonable concern for many recipients.
- First and last name
- Additional personal data elements specific to each individual (as detailed in each personalized notice)
When personal information like this is exposed, the risk of identity theft rises significantly. For instance, if Social Security numbers or financial account details were among the exposed data elements for a given individual, criminals could use that information to open new credit accounts or file fraudulent tax returns. Even name-only exposure can support phishing attempts, since scammers often combine limited data with social engineering to appear legitimate.
In addition, if any health or educational records were part of the impacted files, affected individuals could face risks beyond financial fraud. Medical identity theft, for example, can lead to inaccurate health records or fraudulent insurance claims made in a victim’s name. Because the specific data elements vary by recipient, individuals should carefully review their personalized notification letter to understand their own exposure.
What is the company doing?
Once SCUHS became aware of the unauthorized activity, it acted quickly to secure its network. The university brought in outside cybersecurity specialists to investigate the scope of the intrusion and restore normal system functionality. This response also included a thorough review of the files that were accessed, so the university could determine which individuals needed to be notified.
Following the investigation, SCUHS began sending written notification letters to affected individuals. The university has also implemented additional security safeguards to protect data going forward. Furthermore, SCUHS says it is continuing to review and strengthen these protections as part of an ongoing security commitment. As a precaution, the university is offering twelve months of credit monitoring and identity protection services through Kroll to those affected.
What Should Affected Individuals Do?
Enroll in the Free Credit Monitoring Services
Affected individuals should take advantage of the twelve months of credit monitoring and identity protection services offered through Kroll. This service includes single-bureau credit monitoring, which alerts you when new credit activity appears on your file. Enrollment requires visiting the Kroll enrollment website and using the membership number included in your personal notification letter.
Because there is a deadline to activate these services, it’s important to enroll as soon as possible after receiving your letter. Once enrolled, you’ll also gain access to unlimited fraud consultation support. This means a Kroll specialist can help you interpret suspicious account activity and explain your rights if you ever suspect identity theft.
Monitor Your Credit Reports Regularly
In addition to the offered monitoring service, you should request your free credit reports from Equifax, Experian, and TransUnion through annualcreditreport.com. Reviewing these reports lets you check for unfamiliar accounts or inquiries that could signal fraud. Because credit bureaus only provide one free report per year through this channel, spacing out your requests across the year can help you monitor more consistently.
If you notice anything unusual, report it to the relevant credit bureau right away. This proactive habit is especially useful since not all fraudulent activity triggers an automatic alert from a monitoring service. As a result, personal vigilance remains an important layer of protection.
Consider a Fraud Alert or Credit Freeze
If your notification letter indicates that sensitive identifiers were part of the exposed data, placing a fraud alert on your credit file is a smart precaution. An initial fraud alert lasts one year and requires businesses to verify your identity before extending new credit in your name. This step is free and can be requested directly through any of the three major credit bureaus.
For stronger protection, you might also consider a credit freeze, which restricts access to your credit file entirely. While a freeze requires you to lift it temporarily whenever you apply for new credit, it offers one of the most effective defenses against identity thieves opening accounts in your name. Because both options are free under federal law, there’s little downside to using either one.
Stay Alert for Phishing Attempts
After a data breach, scammers often try to exploit public awareness of the incident by sending phishing emails or texts. These messages may pretend to be from SCUHS, Kroll, or even a credit bureau, asking you to click a link or provide personal details. You should never click on unexpected links or share sensitive information in response to unsolicited messages.
Instead, verify any communication by contacting the organization directly through a known phone number or website. If you’re ever unsure whether a message about this breach is legitimate, you can call the number provided in your official notification letter. Taking a moment to verify can prevent a scammer from turning breach awareness into a second victimization.
Consult a Data Breach Attorney
If you’re concerned about how this breach may affect you long term, speaking with a data breach attorney can help clarify your options. Many attorneys offer free case evaluations and can explain whether you may be eligible to join a class action or pursue compensation. This is especially worthwhile if you experience direct financial harm connected to the exposed information.
Because breach-related litigation timelines can be strict, it’s wise to seek guidance sooner rather than later. An attorney can also help you understand what documentation to keep, such as your notification letter and any evidence of suspicious account activity. This preparation can strengthen your position if you decide to pursue a claim.
More Information
Official data breach notification from California Attorney General