University of Phoenix disclosed a massive data breach affecting approximately 3.5 million individuals after unauthorized external system access was discovered in November 2025.
The breach occurred on August 13, 2025, but remained undetected for three months until November 21, 2025.
Breach Details
An external cyberattack compromised the educational institution’s systems, exposing personal identifiers and sensitive information of current and former students, faculty, and associated individuals.
Among those affected, 9,131 were Maine residents, triggering mandatory state notification requirements.
The university, headquartered at 4035 South Riverpoint Parkway in Phoenix, Arizona, formally notified affected individuals on December 22, 2025.
The disclosure followed investigation and notification procedures required under data protection laws, including Maine’s data breach notification statute.
Response and Support
University of Phoenix has committed to providing complimentary identity theft protection services to all affected individuals.
Constangy, Brooks, Smith & Prophete, LLP, serving as legal counsel, coordinated the breach notification process with all applicable jurisdictions.
Partner Sean B. Hoar confirmed compliance with notification requirements across affected states and consumer reporting agencies.
Maine authorities received formal notification because the threshold was exceeded: more than 1,000 state residents were impacted.
The three-month detection window raises significant questions about the institution’s security monitoring capabilities and incident response procedures.
Educational institutions have become increasingly attractive targets for cyber attackers seeking access to valuable personal and financial information stored in student records and administrative systems.
Affected individuals are advised to monitor credit reports and activate the offered identity theft protection services.
The breach ranks among the most significant incidents in the education sector reported in 2025.
University of Phoenix has not yet disclosed additional details regarding root cause analysis, infrastructure improvements, or comprehensive remediation efforts.
Further updates are expected as the institution completes its formal incident review process.
The incident underscores the persistent cybersecurity challenges faced by higher education institutions that manage vast repositories of sensitive student information.
| Date | Event | Details |
|---|---|---|
| August 13, 2025 | Unauthorized Access | External hacking attack compromised systems |
| November 21, 2025 | Breach Discovery | Unauthorized access detected after 3-month gap |
| December 22, 2025 | Formal Notification | University notifies affected individuals |
| Ongoing | Investigation | Root cause analysis and remediation underway |
| Affected Data Categories | Number of Individuals | Status |
| Personal Identifiers | 3,500,000+ | Exposed |
| Student Records | Included | Exposed |
| Faculty Information | Included | Exposed |
| Maine Residents | 9,131 | Notified |
FFollow us on Google News , LinkedIn and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
%20(2)%20(1).webp?fit=1600,900&ssl=1&description=University of Phoenix disclosed a massive data breach affecting approximately 3.5 million individuals after unauthorized external system access was discovered in November 2025.){kind=link}