Monroe University Data Breach Exposes 320,000 People’s Personal and Financial Data in 2024 Cyberattack

Major university breach highlights growing wave of cyberattacks targeting educational institutions across America

NEW YORK — Monroe University has confirmed that a December 2024 data breach compromised the personal, financial, and health information of 320,973 individuals after cybercriminals infiltrated its computer systems for two weeks.

The private institution, which enrolls over 9,000 students annually across campuses in the Bronx, New Rochelle, and Saint Lucia, disclosed the security incident in breach notifications filed with the Office of the Maine Attorney General this week.

According to the university’s official statement, threat actors maintained unauthorized access to Monroe’s network from December 9 through December 23, 2024. The institution didn’t confirm the full scope of the cyberattack until September 2025, following an extensive review of compromised files.

Extensive Personal Data Compromised

The stolen information varied by individual but potentially included highly sensitive data: names, dates of birth, Social Security numbers, driver’s license numbers, passport numbers, government identification numbers, medical records, health insurance details, email credentials and passwords, financial account information, and student records.

“We reviewed these files and, on September 30, 2025, determined that they contained some personal information for certain individuals,” the school stated in its breach notification.

Response and Victim Protection

Monroe University began mailing breach notifications on January 2 to all affected individuals, urging them to monitor credit reports and account statements for potential fraud or identity theft. The institution is offering one year of complimentary credit monitoring services through Cyberscout, which will alert victims to any changes in their credit files.

When contacted for additional details about the security incident, a Monroe University spokesperson declined to provide further information.

This isn’t the first time Monroe has fallen victim to cybercriminals. When the school operated as Monroe College, ransomware attackers demanded 170 bitcoins approximately $2 million at the time for a decryption key.

Escalating Threat to Higher Education

The Monroe University breach is part of an alarming trend of cyberattacks targeting American educational institutions. Multiple universities have reported similar security incidents in recent months:

The University of Hawaii disclosed last month that its Cancer Center suffered a ransomware attack in August 2025. Baker University revealed in December that a 2024 network breach resulted in the theft of personal, health, and financial data belonging to over 53,000 individuals.

Several prestigious institutions including Harvard University, Princeton University, and the University of Pennsylvania fell victim to voice phishing attacks beginning in October. These sophisticated social engineering schemes compromised development and alumni systems, exposing donor, staff, student, and alumni information.

The Clop ransomware gang also breached Oracle E-Business Suite platforms at Harvard University and the University of Pennsylvania, stealing personal and financial data from students, staff, and suppliers.

Growing Cybersecurity Concerns

The wave of data breaches affecting educational institutions underscores the urgent need for enhanced cybersecurity measures in the higher education sector. Universities hold vast repositories of sensitive personal, financial, and health information, making them attractive targets for cybercriminals seeking valuable data for identity theft, financial fraud, and ransomware extortion.

Security experts warn that educational institutions often struggle with cybersecurity due to limited IT budgets, decentralized network architectures, and the challenge of securing systems accessible to thousands of students, faculty, and staff.

As cyberattacks continue to escalate, students and employees at universities nationwide are advised to remain vigilant, use strong unique passwords, enable multi-factor authentication, and monitor their financial accounts for suspicious activity.