Monroe University suffers data breach impacting 320,000 people

Monroe University has disclosed a major data breach affecting more than 320,000 individuals, following a prolonged forensic investigation that concluded nearly a year after the intrusion took place.

Although no evidence of fraud or identity theft has been detected, the exposed data includes a broad spectrum of sensitive personal information.

The breach was first uncovered on September 30, 2025, when Monroe determined that an unauthorized third party had accessed its internal systems and exfiltrated data during a two-week period between December 9 and December 23, 2024. The university began notifying impacted individuals via mailed letters on January 2, 2026.

As also disclosed on Monroe University’s website, the breach compromised a range of personal identifiers, varying by individual. These include:

• Full names
• Social Security numbers
• Dates of birth
• Driver’s licenses
• Passport numbers
• Medical and health insurance data
• Credentials for electronic and financial accounts
• Various student records

Located in New Rochelle, New York, Monroe University is a private institution with a student body primarily composed of first-generation college students and non-traditional learners. It offers undergraduate and graduate degrees across business, healthcare, criminal justice, and information technology.

In response to the breach, Monroe enlisted digital risk management provider Cyberscout to offer one year of complimentary triple-bureau credit monitoring and fraud assistance services to affected individuals. The university also states it has taken internal steps to enhance its cybersecurity posture, although it has not disclosed the specific nature of those improvements.

The extended gap between breach occurrence and discovery, a full nine months, raises questions about monitoring efficacy and response protocols. The institution has not made public whether the intrusion was the result of ransomware, credential compromise, or another method of unauthorized access, nor has it disclosed whether law enforcement is involved.

For those affected, Monroe advises ongoing vigilance, including reviewing financial statements and credit reports, placing fraud alerts or credit freezes where appropriate, and reporting any suspicious activity to relevant authorities. While identity theft protection services are offered, the diverse scope of the compromised data makes individual diligence essential over the coming months.