Strategic Education data breach: Strayer and Capella students' ID numbers in files copied in February

What happened at Strategic Education?

The company's quarterly report says it detected unusual activity in its U.S. network on February 25, 2026, isolated the affected part and shut off access. It says taking systems offline prevented the encryption of its data, and that normal operations resumed in less than a week. The incident did not reach its Australia and New Zealand operations or its ETS operations, including Sophia Learning.

Strategic Education described the incident in its 10-Q; its 8-Ks filed between February and July 2026 are earnings reports under Item 2.02, with none about the incident. The 10-Q said the company believed it would not have a material adverse effect on its financial statements or operations. The Item 1.05 guide explains when a company files an 8-K instead.

Date	What the filings and the regulators' records say
February 23, 2026	Unauthorized access begins
February 25, 2026	Unusual activity detected; affected systems isolated; access ends
April 23, 2026	First-quarter 10-Q describes the incident
May 21, 2026	The company determines what the copied files contained
May 29, 2026	Indiana's report gives this as the date notice was sent
June 1, 2026	Recorded by California, Washington and Massachusetts
June 2, 2026	Posted on the Texas attorney general's list
November 5, 2026	Third-quarter 10-Q says the notices have gone out

Notice went out 93 days after detection. Most of that gap was the file review, which ended on May 21.

Why did I get a letter from Strategic Education?

The letter is sent in the name of Strategic Education as the parent of Strayer University, Capella University or both; the filed template fills in the university that applies to each reader. Strategic Education is the company behind both universities, so a Strayer or Capella student or graduate can get a letter that does not lead with the university's name. The guide to school and education breach notices compares other education letters.

What information was involved?

Each letter names the reader's own items from three: Social Security number, driver's license number and passport number, together with the name. The state records match that list.

Regulator	Information it records
Washington attorney general	Name; Social Security number; driver's license or Washington ID card number; passport number
Texas attorney general	Name; Social Security number; driver's license number; government-issued ID number
Massachusetts consumer affairs office	Social Security numbers and driver's licenses marked as breached; financial accounts, medical records and payment cards not

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Total affected	1,513,518
Texas attorney general	Texans	100,845
Indiana attorney general	Indiana residents	21,864
Washington attorney general	Washingtonians	14,112
Massachusetts consumer affairs office	Massachusetts residents	8,188

What is Strategic Education offering?

A complimentary membership in Kroll's identity monitoring, with single-bureau credit monitoring, fraud consultation and identity theft restoration. The number of years and the activation deadline are blank fields in the filed copy, so each letter carries its own.

Item	Detail from the letter
Provider	Kroll
Enrollment	enroll.krollmonitoring.com, with the membership number on the letter
Length and deadline	Printed on each letter
Phone	(844) 959-7093, Monday to Friday, 8:00 a.m. to 5:30 p.m. Central Time, excluding major U.S. holidays
Credit services	Need an adult with established U.S. credit, a Social Security number and a U.S. address on the credit file

What the documents leave open

• How the actor got into the servers.
• How many of the 1,513,518 are Strayer and how many Capella records.
• Why the files held passport numbers.