University of Phoenix 2026 3.5M Data Breach

The University of Phoenix, a for-profit higher education institution, experienced a data breach affecting approximately 3.5 million individuals. The breach was publicly disclosed in February 2026, though the internal discovery timeline remains unspecified. This incident represents one of the largest education sector breaches in recent years, impacting current and former students, faculty, and staff across the university's nationwide operations.

The Clop ransomware collective claimed responsibility for the attack, employing ransomware as the primary attack vector. While specific exploitation techniques and affected systems were not detailed in the initial disclosure, the ransomware group's involvement suggests a combination of initial access methods leading to data encryption and exfiltration. The exact data types compromised have not been fully enumerated in public reporting, though ransomware attacks typically target personally identifiable information, financial records, and institutional data.

No post-incident developments regarding regulatory actions, litigation, ransom payments, or remediation milestones were confirmed in the initial disclosure. The university has initiated breach notification procedures to affected individuals as required by state and federal regulations governing educational institutions and data protection.