Monroe University data breach: 320,973 people, a year after the December 2024 intrusion

How many people were affected by the Monroe University data breach?

320,973 in total, according to the number Monroe University reported to Indiana. The letter gives no count. The state lists count their own residents:

Regulator	Who it counts	Number	Recorded
Indiana attorney general	Total reported by Monroe University	320,973	Notice January 2, 2026
Texas attorney general	Texans	3,075	Posted January 14, 2026
Massachusetts consumer affairs office	Massachusetts residents	875	Reported January 13, 2026
Indiana attorney general	Indiana residents	173	Notice January 2, 2026

Texas's attorney general lists 3,075 Texans for Monroe University, posted on January 14, 2026.

Monroe University's 320,973 is the 27th largest total among the 2026 notices on Indiana's list. The ranking of 2026's largest breaches lists the 25 above it and cites Monroe University's row when it explains how long notices can take.

Why did Monroe University take a year to send letters?

The letter gives two dates that explain most of the gap, but no reasons. The access ended on December 23, 2024. The file review concluded on September 30, 2025, 281 days later. Notices reached Indiana 94 days after that.

Date	Event
December 9, 2024	Unauthorized access begins
December 23, 2024	Access ends
September 30, 2025	Review of the copied files concludes
January 2, 2026	Notice recorded in Indiana
January 13, 2026	Notice recorded in Massachusetts

The letter does not say when Monroe University discovered the intrusion, only that it launched an investigation once it did. The state-by-state guide to breach notification laws sets out the deadlines that apply once a breach is found.

What information was involved?

Each letter pairs the reader's name with its own list of data elements; the filed copy leaves that list blank. Massachusetts' record shows which categories were involved for its 875 residents: Social Security numbers, medical records, financial accounts and driver's licenses. The letter says Monroe University has no evidence the information has been used for identity theft or fraud.

What is Monroe University offering?

Item	Detail from the letter
Service	Two years of triple-bureau credit monitoring (Experian, Equifax and TransUnion alerts) with proactive fraud assistance, from Cyberscout through Identity Force, a TransUnion company
Enrollment	Within 90 days of the letter date, with the code printed on the letter; an email account is needed, and minors under 18 may not be able to enroll
Help line	833-996-3674, 8 a.m. to 8 p.m. Eastern, Monday through Friday

The 90-day window has closed for letters sent in January 2026. The letter's other advice still applies: review account statements and credit reports, and consider a fraud alert or a free security freeze. The guide to credit monitoring offers compares offers like this one.

What the documents leave open

• When Monroe University discovered the intrusion, and how the third party got in.
• Whether the 320,973 are students, former students, applicants or staff.
• Why the notices came 94 days after the review ended.