Kaplan data breach: files with Social Security and driver's license numbers taken from its servers

What happened in the Kaplan data breach?

Kaplan says it secured its network when it discovered the incident, investigated with outside IT security specialists and alerted law enforcement. The letter does not give the date of discovery. It says Kaplan has also taken steps to help prevent the spread of the files that were taken.

Date	What the letter and the regulators' records say
October 30, 2025	The unauthorized access begins; breach date on the California, Washington and Indiana records
November 18, 2025	The access ends
February 21, 2026	Kaplan determines which people's information was in the files
March 17, 2026	Date printed on the letter; notice recorded by California and Washington; report logged in Massachusetts; Indiana's report gives this as the date notice was sent
March 18, 2026	Posted on the Texas attorney general's list

The letters went out 24 days after Kaplan identified whose information was involved, and four months after the access ended.

What information was involved?

Names, Social Security numbers and driver's license numbers, in some combination for each person. Every state record agrees: Washington and Texas list those three items, and Massachusetts marks Social Security numbers and driver's licenses as breached and medical records, financial accounts and payment cards as not breached. No health or payment data is listed anywhere.

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Total affected, as reported to Indiana	1,403,060
Indiana attorney general	Indiana residents	6,238
Texas attorney general	Texans	173,676
Washington attorney general	Washingtonians	18,885
Massachusetts consumer affairs office	Massachusetts residents	10,260
Maine (as The Record reported it)	Maine residents	19,075
South Carolina (as The Record reported it)	South Carolina residents	About 26,600
New Hampshire (as The Record reported it)	New Hampshire residents	More than 11,600

Kaplan is 15th in the national ranking from Indiana's report. The school and education notices guide covers other education breaches.

Why did the Kaplan count jump from 230,000 to 1.4 million?

Because the first public figures were state counts. A week after Kaplan's first state filings, The Record added up the numbers the states published: 230,941 people. Maine counted 19,075, South Carolina about 26,600, Texas 173,676 and New Hampshire more than 11,600. The Record then updated its report on March 24: Kaplan had told Oregon's regulators that 1.4 million people were affected. Indiana's report has the exact total, 1,403,060, so the national figure is about six times the first published sum.

Who was behind the Kaplan breach?

Nobody has said. The Record reported that no hacking group had claimed the incident. A Kaplan spokesperson told The Record that the investigation was complete and that an unauthorized third party had accessed certain information in its network. The Record described Kaplan as best known for SAT and ACT test prep, serving about 1.2 million students, and as owned by Graham Holdings.

What is Kaplan offering people who got a letter?

A complimentary one-year membership in Experian IdentityWorks.

Item	Detail from the letter
Provider	Experian IdentityWorks
Length	One year
Enrollment	Instructions and code on the pages that follow the letter
Phone	1-833-931-4400, Monday to Friday, 9 am to 9 pm Eastern Time

What the documents leave open

• How the unauthorized actor got in, and whether ransomware was involved.
• Whose records were in the files: students, test-takers, employees or others.
• What "steps to help prevent the dissemination" of the files means.

Was my Social Security number exposed in the Kaplan breach?

Possibly. The letter says each person's files contained their name, Social Security number and/or driver's license number, so some people had one and not the other. Your letter is the answer for your own data.