University of Phoenix
Disclosed Dec 2, 20259 months ago3,500,000 affectedConfirmed
Clop Oracle EBS hack exposes 3.5M University of Phoenix records
University of Phoenix said Clop exploited the Oracle E-Business Suite zero-day in August 2025 to take names, contact details, birth dates, SSNs and bank account and routing numbers of students, staff and suppliers; it detected the breach on November 21 and later notified nearly 3.5 million people.
What is known
| People affected | 3,500,000 (as reported by the organization) |
|---|---|
| Disclosed | Dec 2, 2025 |
| Discovered | Nov 21, 2025 |
| Happened | Aug 13, 2025 |
| Attack | Supply chain |
| Data exposed | Names, Dates of birth, Social Security numbers, Financial, Addresses, Phone numbers, Emails, Payment cards |
| Sector | Education · US |
| Status | Confirmed |
| Part of | Oracle ebs (2025) |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: University of Phoenixoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: University of Phoenixatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: University of Phoenixattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: University of Phoenixjustice.oregon.gov · Official notice | Official notice |
| University of Phoenix data breach impacts nearly 3.5 million individualsbleepingcomputer.com · News | News |
| University of Phoenix discloses data breach after Oracle hackbleepingcomputer.com · News | News |
| Phoenix Education Partners Form 8-K Item 8.01sec.gov · SEC filing | SEC filing |
| Texas Attorney General data security breach report BR-0004750: University of Phoenixoag.my.site.com · Official notice | Official notice |
| Indiana Attorney General 2025 data breach report: University of Phoenixin.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Dec 2, 2025 | 3,500,000 |
| California AGresidents of CA | Dec 21, 2025 | |
| Washington AGresidents of WA | Dec 21, 2025 | 64,796 |
| Oregon DOJresidents of OR | Dec 21, 2025 | 3,489,274 |
| Delaware DOJresidents of DE | Dec 22, 2025 | 7,810 |
| Texas AGresidents of TX | Dec 22, 2025 | 304,393 |
| Indiana AGresidents of IN | Dec 22, 2025 | 56,568 |
Same campaign
Other breaches at University of Phoenix
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Dec 30, 2020Dec 30, 20205 years ago | Dec 30, 20205 years ago | Not stated | Education | Confirmed | 27 |
History of this record
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2025.pdf · backfill source
- 2026-09-25 · data_types: ["names","dob","ssn","financial","addresses","phone","emails"] to ["names","dob","ssn","financial","addresses","phone","emails","payment-card"] · backfill source
- 2026-09-25 · campaign: empty to oracle-ebs-2025 · seed source
- 2026-09-25 · attack: hacking to supply-chain · seed source
- 2026-09-25 · data_types: ["names"] to ["names","dob","ssn","financial","addresses","phone","emails"] · seed source
- 2026-09-25 · records: 3489274 to 3500000 · seed source
- 2026-09-25 · disclosed: 2025-12-21 to 2025-12-02 · seed source
- 2026-09-25 · summary: empty to University of Phoenix said Clop exploited the Oracle E-Business Suite zero-day in August 2025 to take names, contact details, birth dates, SSNs and bank account and routing numbers of students, staff and suppliers; it detected the breach on · seed source
- 2026-09-25 · title: empty to Clop Oracle EBS hack exposes 3.5M University of Phoenix records · seed source
- 2026-09-25 · data_types: [] to ["names"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 3489274 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2025-11-21 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.