| The University of Phoenix has disclosed a data breach affecting nearly 3.5 million individuals after attackers gained unauthorized access to its Oracle E Business Suite financial system during an intrusion that occurred between August 13 and August 22, 2025, and remained undetected until November 21, shortly after the university was listed on the Clop ransomware gang leak site. Notifications to regulators and affected individuals confirmed that sensitive personal and financial information belonging to current and former students, employees. Faculty and suppliers were exposed including names contact details dates of birth social security numbers and bank account information, although the university stated the banking data was accessed without a direct method for misuse. The breach is believed to be part of a broader campaign linked to a zero-day vulnerability in Oracle E-Business Suite, tracked as CVE-2025-61882, which has been exploited against more than 100 organizations across multiple sectors and ranks among the largest ransomware related data exposures reported in 2025 based on the number of records affected. While Clop has claimed responsibility some researchers have expressed caution around attribution and no University of Phoenix data has been publicly released to date but the incident highlights ongoing systemic cybersecurity challenges within higher education as similar Oracle E Business Suite compromises have been confirmed at institutions including Harvard the University of Pennsylvania and Dartmouth College. CTIX will continue to report on relevant threat actors and their campaign activity.
|