Loading story…
Columbia University disclosed a data breach that exposed Social Security numbers and other personal data, including records belonging to people who said they had no direct relationship with the school. Reporting found Columbia had retained legacy applicant and recruitment data from before 2012, when universities received student information from scholarship, recruitment, and testing sources; some affected individuals learned their SSNs were stored by Columbia despite never attending or applying. The incident has drawn scrutiny over long-term retention of sensitive data and the university’s notification process, with some breach notices reportedly sent to outdated family addresses because current contact details were unavailable.
The disclosure also raised questions about how student data was historically shared across the admissions ecosystem. Columbia said the exposed records appear tied to older datasets, while the College Board said its Student Search program would not have provided SSNs to Columbia and that, before ending SSN sharing in 2018, the relevant scenario would have been students sending SAT scores to the university; ACT likewise no longer uses SSNs as student identifiers. Separately, Santa Clara University confirmed a breach affecting 2,206 records, underscoring continued exposure risks across higher education institutions handling sensitive student and applicant information.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Following a Columbia University data breach, some recipients reported their Social Security numbers were exposed even though they had no direct relationship with the school. The article says delayed notifications drew criticism, with some notices reportedly sent to parents' addresses because current contact information was hard to locate.
Ars Technica confirmed that ACT no longer uses Social Security numbers as student identifiers, and that the practice ended roughly a decade earlier.
Columbia University said that before 2012 it received prospective student data, including Social Security numbers, from multiple recruitment, scholarship, and testing sources. The university indicated this legacy data appears to have remained in its databases.
The College Board said it ended sharing Social Security numbers in 2018. It also disputed that its Student Search opt-in program would have provided a student's SSN to Columbia.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
National Public Data disclosed a security incident affecting a large repository of consumer background-check and people-search information, with exposed data reported to include highly sensitive personal identifiers such as **Social Security numbers**, names, mailing addresses, and other profile details. The company published a breach notice on its website, while an individual notification letter filed with the California Attorney General indicates affected residents were formally notified that their information may have been involved. The incident drew attention because the compromised records appear to involve data commonly used for identity verification and fraud, increasing the risk of **identity theft**, account takeover, and social-engineering abuse. The notification materials show the breach response included direct notice to impacted individuals and guidance on protective steps such as monitoring accounts and credit activity, underscoring the seriousness of the exposure for consumers whose records were held by the data broker.
Jul 12, 2026
Princeton University disclosed that its Advancement database, containing personal information of alumni, donors, some faculty, students, parents, and other community members, was compromised by unauthorized actors on November 10. The breach lasted less than 24 hours, and while the investigation is ongoing, the university stated that the database generally does not contain Social Security numbers, passwords, or financial data such as credit card or bank account numbers. The exposed data includes names, email addresses, phone numbers, and home and business addresses, as well as donation information. University officials have communicated with affected individuals, urging vigilance against potential phishing attempts and confirming that no other systems were accessed during the incident. The university is working with external experts and law enforcement to determine the full scope of the breach and its impact. Princeton emphasized that student records protected by federal privacy laws and most staff data were not included in the compromised database. This incident follows a series of recent data breaches at other Ivy League institutions, highlighting ongoing threats to higher education data security. The university has provided a dedicated FAQ and incident information page to keep the community informed as the investigation progresses.
Jul 12, 2026
A hacker gained unauthorized access to the University of Pennsylvania's Salesforce Marketing Cloud mailing system, using it to send a mass email to approximately 700,000 recipients and mock the university's security and admissions practices. The attacker claimed to have exfiltrated sensitive data on 1.2 million donors, alumni, and students, including names, birthdates, addresses, contact information, estimated net worth, donation history, and demographic details such as religion, race, and sexual orientation. The university confirmed the breach originated from its connect.upenn.edu platform, which is hosted by Salesforce, and that the attacker was able to distribute the message widely before losing access on October 31. Despite losing initial access, the attacker asserted continued control over the Salesforce Marketing Cloud system and subsequently published a 1.7-gigabyte archive allegedly containing the stolen data. The incident highlights significant risks associated with third-party cloud-based communication platforms and the potential for large-scale exposure of sensitive personal and financial information. The breach has raised concerns about the security of university systems and the protection of donor and student data, with the attacker openly ridiculing the institution's cybersecurity posture in the process.
Jun 29, 2026