University of Phoenix data breach: Oracle E-Business Suite theft in August 2025, 3,489,274 people notified

What happened at the University of Phoenix?

Phoenix Education Partners told the SEC on December 2, 2025 that the university was one of a number of organizations, including other academic institutions, whose data an unauthorized party took through a previously unknown flaw in Oracle EBS. It said the flaw was used in August 2025 to copy data held in the university's EBS environment, and that it installed Oracle's patches after their release in October 2025. The filing went under Item 8.01, "other events", and said the incident had not affected business operations or student programs.

The notice to Washington's attorney general narrows the dates: the data was taken between August 13 and 22, 2025. The company also said that, as far as it knew, the attacker had not published the data.

Date	What happened	Source
August 13 to 22, 2025	Data copied from the university's Oracle EBS environment	Washington notice
October 2025	Oracle releases patches; the university installs them	Form 8-K
November 21, 2025	The university detects the incident	Form 8-K
December 2, 2025	Form 8-K, Item 8.01	SEC EDGAR
December 21, 2025	Notice to Washington's attorney general	Washington notice and list
December 22, 2025	Letters begin; Indiana's notice date; Texas publishes the report	Washington notice; Indiana and Texas records
November 3, 2026	10-K says the incident has not materially affected the business	Form 10-K

Letters began 122 days after the theft ended and 31 days after detection. The Oracle E-Business Suite breach list sets the university beside the seven other organizations whose notices name EBS. Its notice is by far the largest of them.

What information was taken in the University of Phoenix breach?

Names and contact information, dates of birth, Social Security numbers, and bank account and routing numbers. The Washington notice gives the same list and adds that the bank account numbers were taken without the means to access the accounts. Texas's record shows 304,393 Texans in the notice. Washington's list shows 64,796 Washington residents.

The filings do not say whose records the system held, students, former students, staff or others, or why it held bank routing numbers.

How many people were affected by the University of Phoenix breach?

3,489,274 people, in Indiana's record. Texas counts 304,393 of them, Washington 64,796 and Indiana 56,568. Among the eight organizations whose notices name Oracle EBS, it is the largest by far: the other five notices with an Indiana total add up to 177,989 people. Indiana's 2026 notices are ranked in the largest data breaches of 2026; this one is in the 2025 report, because the letters went out in December 2025, and it is third in the largest data breaches of 2025.

What is the University of Phoenix offering?

The sample letter offers complimentary identity protection through IDX: 12 months of credit monitoring, dark web monitoring, a $1 million identity fraud loss reimbursement policy, and identity theft recovery services. The enrollment deadline in the sample was March 22, 2026, so a code from the December letters will usually have expired. The university set up a toll-free call center through IDX for questions. The guide to credit monitoring offers explains what to do when an offer has lapsed.

Did the breach hurt the University of Phoenix's business?

Not materially, by the company's account. Its 10-K for the year to August 31, 2026 says its business strategy, results and financial condition have not been and are not reasonably likely to be materially affected by cybersecurity risks, including the Oracle EBS incident detected in November 2025. The guide to what later 10-Q and 10-K filings say shows how other companies closed out an incident in their filings.

Was my information in the University of Phoenix data breach?

If you got a letter from the University of Phoenix dated December 22, 2025 or later, sent from a return mail center in Suwanee, Georgia, your information was in the copied data. Because bank account and routing numbers were in the files with Social Security numbers, watch bank statements as well as credit reports. If you think you should have had a letter, IDX's call center for the university is the channel the notice gives.

What the filings leave open

• Whose records the 3,489,274 people are: current or former students, staff, or others.
• How the university learned of the theft on November 21, 2025.
• Who carried out the attack; none of the filings names a group.