Loading story…
Baker University in Kansas disclosed a significant data breach after detecting suspicious activity and a network outage in December 2024. An investigation revealed that attackers had unauthorized access to the university’s systems between December 2 and December 19, 2024, resulting in the theft of sensitive documents containing personal, health, and financial information of 53,624 individuals. The compromised data included names, dates of birth, Social Security numbers, driver’s license numbers, financial account details, health insurance and medical information, passport numbers, student identification numbers, and tax identification numbers. The university has stated there is no evidence so far that the stolen information has been used for fraudulent activities.
In response to the breach, Baker University has offered free credit monitoring services to affected individuals and has notified state and federal regulators. The university worked with external cybersecurity experts to investigate the incident, rebuild compromised platforms, and implement additional security measures to prevent future incidents. The nature of the attack and the identity of the perpetrators have not been disclosed, and there is no public evidence of extortion or ransom demands related to the breach. The university continues to encourage those affected to monitor their accounts and credit reports for suspicious activity.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Baker University publicly disclosed that a December 2024 breach affected more than 53,000 individuals. The university said it notified affected people and regulators and offered complimentary credit monitoring.
In December 2024, the university discovered the incident after a network outage and began securing systems and investigating the breach. It also engaged external cybersecurity experts and started rebuilding compromised systems.
Baker University said unauthorized actors accessed its network between December 2 and December 19, 2024. During this period, sensitive personal, financial, and medical information was exposed.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
University of Phoenix suffered a major data breach affecting approximately 3.5 million individuals, including students, staff, and suppliers, after attackers exploited a zero-day vulnerability in the Oracle E-Business Suite (EBS) financial application. The breach, attributed to the Clop ransomware gang, resulted in the exposure of sensitive personal and financial information such as names, contact details, dates of birth, Social Security numbers, and bank account information. The incident was discovered on November 21, 2025, several months after the initial compromise in August, highlighting significant gaps in the university’s security monitoring and detection capabilities. Following regulatory requirements, especially in Maine where over 9,000 residents were affected, the University of Phoenix issued formal notifications and offered complimentary identity theft protection services, including credit monitoring and fraud reimbursement. The breach has raised concerns about the adequacy of cybersecurity defenses in higher education and prompted the university to engage legal counsel and external experts to manage the response and notification process. The Clop ransomware group’s involvement and the exploitation of a critical Oracle EBS vulnerability underscore the evolving threat landscape facing educational institutions.
Jun 29, 2026
The University of Phoenix disclosed a significant data breach after attackers exploited a zero-day vulnerability in the Oracle E-Business Suite (EBS) financial application. The breach, detected on November 21, 2025, resulted in unauthorized access to sensitive personal and financial information, including names, contact details, dates of birth, Social Security numbers, and bank account information of numerous current and former students, employees, faculty, and suppliers. The incident was revealed after the university was listed on the leak site of a prominent Russian extortion group, believed to be the Clop ransomware gang, which has targeted multiple U.S. educational institutions through the same Oracle EBS vulnerability. The university's parent company, Phoenix Education Partners, filed a notice with the U.S. Securities and Exchange Commission (SEC), confirming the breach and stating that cybersecurity insurance would cover the response and remediation costs. While the attackers have not publicly disseminated the stolen data, the university is continuing its investigation and will notify affected individuals and regulatory entities. The breach is part of a broader campaign that has impacted other major universities, highlighting the risks associated with unpatched enterprise software vulnerabilities.
Jun 29, 2026
Baylor Genetics disclosed a data security incident affecting nearly 250,000 individuals after detecting unauthorized activity in parts of its internal network. The company said an unauthorized third party accessed portions of its network and stored data between **June 11 and June 17, 2026**, with the intrusion discovered on **June 15** during that window. Baylor Genetics reported **248,430** affected individuals to Texas regulators and notified law enforcement as it investigated the breach. The exposed information included sensitive personal, medical, insurance, and **Social Security** data, while some current and former employees also had government identification and financial account information compromised. Baylor Genetics said it has secured affected systems and strengthened security controls following the incident, and reported that it had not identified misuse of the stolen information at the time of disclosure. No threat actor had publicly claimed responsibility.
Aug 25, 2026