Education sector data breaches expose student records, Social Security numbers, financial aid information, grades, disciplinary records, and sometimes health records at K-12 schools, colleges, and universities. Because many affected individuals are minors, these breaches carry a heightened long-term identity theft risk that can go completely undetected for years, since a stolen child’s identity is rarely checked against credit reports until adulthood. Schools and universities are frequent ransomware targets due to often-limited cybersecurity budgets relative to the volume of sensitive data they store, including admissions records, financial aid applications, and staff payroll information. Parents, students, faculty, and staff can all be affected by a single incident at an educational institution. This page tracks confirmed data breaches at schools, colleges, and universities, including what data was exposed, which companies or institutions notified regulators, and what affected individuals and families can do next to monitor for identity theft and understand their legal rights.
Nelson University notified the Vermont Attorney General of a data breach that exposed Social Security numbers, putting affected individuals at risk of identity theft.
Nelson University Data Breach Exposes Social Security Numbers Read More »
Santa Monica Community College notified regulators that a data breach compromised Social Security numbers belonging to students or employees, prompting concerns about identity theft.
Santa Monica Community College Data Breach Exposes Social Security Numbers Read More »
Sumner County Schools in Tennessee discovered a data breach in its computer network that forced officials to delay the start of the school year while the district investigates and secures its systems.
Sumner County Schools Data Breach Exposes Student and Staff Personal Information Read More »
Las Lomitas Elementary School District has notified staff and caregivers that a threat actor accessed personal information stored on the Canvas learning management platform, affecting students, caregivers, and staff from the 2023-2024 school year.
Las Lomitas Elementary School District Data Breach Exposes Student and Staff Information Read More »
Tulane University has notified individuals that a zero-day flaw in Oracle’s E-Business Suite exposed names, Social Security numbers, and direct deposit banking information tied to human resources files.
Tulane University Data Breach Exposes Social Security Numbers and Banking Information Read More »
Southern California University of Health Sciences notified individuals that an unauthorized actor viewed and copied files containing personal information during a network intrusion in March 2026.
The International Center of Photography notified the Delaware Attorney General of a data breach that exposed sensitive personal information belonging to students, staff, or program participants.
PowerSchool notified affected individuals and the Delaware Attorney General after a data breach exposed sensitive student and parent personal information held in its school management system.
PowerSchool Data Breach Exposes Student and Parent Personal Information Read More »
Instructure, the company behind the Canvas learning management system, confirmed a cybersecurity incident in which a hacking group claims to have stolen 3.65 terabytes of data from its network.
Instructure Data Breach Exposes Student Names, Emails and ID Numbers Read More »
An extortion campaign exposed nearly 800,000 email addresses along with Social Security numbers, academic records, and other personal data tied to Glendale Community College.