Tulane University data breach: HR files taken through an Oracle E-Business Suite zero-day

What happened at Tulane?

The way in was a flaw in Oracle's software that had no patch when it was used. When Tulane learned of the zero-day, it started an investigation, notified law enforcement and applied the patches Oracle provided. The investigation found that on August 10, 2025 the flaw had let unauthorized parties access and acquire files stored in the application. The letter does not say when Tulane learned of the flaw or who the attackers were.

California's record gives August 10, 2025 as the date of the breach. Working out whose information was in the files took seven months. Tulane determined on March 12, 2026 that files held a given person's data. It notified people three weeks later, 235 days after the files were taken.

Date	What happened	Source
August 10, 2025	Files in the E-Business Suite application accessed and taken	Notice letter, California AG record, Indiana record
October 6, 2025	CISA adds Oracle E-Business Suite flaw CVE-2025-61882 to its exploited list	CISA KEV catalog
March 12, 2026	Tulane finds each recipient's information in the files	Notice letter
April 2, 2026	Notice sent, per Indiana	Indiana record
May 14, 2026	Published by Texas	Texas AG list

Which Oracle E-Business Suite flaw was it?

The letter does not name one. It calls the flaw a zero-day in Oracle's E-Business Suite and says Tulane has worked with Oracle and outside cybersecurity firms to make sure it has been eliminated. CISA's Known Exploited Vulnerabilities catalog lists several E-Business Suite flaws. One, CVE-2025-61882 in the BI Publisher Integration component, was added on October 6, 2025, two months after Tulane's files were taken. CISA marks it as known to have been used in ransomware campaigns. Tulane's letter does not cite that CVE or any other, so this log does not tie the two. A university's own notice is the record of what happened to its files. The guide to vendor and cloud breaches in 8-K filings shows how listed companies describe a flaw in software they run but do not make.

Tulane is one of eight organizations whose own breach notices name Oracle E-Business Suite. The list of Oracle E-Business Suite breach notices ranks them by the number of people notified.

What information was in the Tulane files?

The letter names three items for the person it is addressed to: name, Social Security number, and direct deposit and banking information. Texas lists the same three: name, Social Security number and financial information. The letter does not say whether the people affected are current staff, former staff, student workers or others paid through the system.

How many people were affected by the Tulane breach?

Indiana gives the only total: 80,867 people. Two states count their own residents:

Record	People counted
Indiana attorney general, total	80,867
Texas residents	2,992
Indiana residents	273

Texas published its report on May 14, 2026. The Rhode Island line in the filed sample is a placeholder, "<<RI Count>>", so the California copy gives no count of its own. The ranking of 2026 breaches by people affected shows where the Indiana total falls.

What is Tulane offering?

A free Experian IdentityWorks Credit 3B membership, which monitors all three credit bureau files and includes identity restoration and $1 million of identity theft insurance. The length is left as a choice in the filed sample, "[one-/two-]year", so each letter says which. Enrolment is at experianidworks.com/3bcredit with the activation code in the letter, by the deadline printed in it, and Experian's line is 833-918-1121. The guide to credit-monitoring offers compares this offer with others in this log.

Was my information in the Tulane University data breach?

A letter from Tulane in spring 2026, sent through a "Secure Processing Center" in Central Islip, New York, means Tulane found your information in the files. Tulane's line for questions is 844-425-3618, Monday to Friday, 8:00 a.m. to 8:00 p.m. Central Time. The university's main address is 6823 St Charles Ave, New Orleans, and its phone number is (504) 865-5000. Because direct deposit details were in the files, the bank account used for direct deposit is the one to watch, along with the credit report. The guide to school and education breach notices compares what other schools and colleges have told families and staff.

What the notice leaves open

• Which E-Business Suite flaw was used, and when Tulane learned of it.
• Who took the files, and whether any demand was made.
• Whose records the files held: staff, former staff, students or others.
• How many people were affected outside Indiana and Texas; the Rhode Island count in the sample is a placeholder.