2024 Monroe University — cyberattack; 320,973 individuals (Dec; disclosed Jan 2026)
Data compromised
Names, DOB, SSNs, driver’s licenses, passports, medical/health insurance info, student data, financial account info per university notice
Technical writeup
Monroe University, a for-profit institution with campuses in New York and Saint Lucia, confirmed that a cyberattack detected December 23, 2024 involved unauthorized network access from December 9 through December 23, 2024 and exfiltration of files containing sensitive data. After a nine-month file review, the university notified approximately 320,973 individuals starting January 2, 2026. Compromised categories include names, dates of birth, Social Security numbers, government IDs, medical and health insurance information, student data, and financial account information. The HIPAA Journal reported no credit monitoring was offered in the sample notification letter at publication time.
Root cause
Unauthorized third-party network access Dec 9–23, 2024; data exfiltration