Clop Ransomware Gang Breaches University of Phoenix, Exposing 3.5 Million Records
- Securityish
- Threats & Incidents
Quick Summary
The Clop ransomware gang breached the University of Phoenix’s network in August 2025, exposing sensitive data of nearly 3.5 million individuals. The attackers exploited a zero-day vulnerability in the Oracle E-Business Suite, accessing personal information such as names, social security numbers, and bank details. The university has since offered free identity protection services to those affected, highlighting the serious implications of such data breaches for privacy and security.
The Securityish Brief
The University of Phoenix (UoPX) experienced a significant data breach in August 2025, impacting approximately 3,489,274 individuals, including students, staff, and suppliers. The breach was attributed to the Clop ransomware gang, which exploited a zero-day vulnerability in the Oracle E-Business Suite (CVE-2025-61882) to access sensitive personal and financial information. The university disclosed the incident in early December 2025, following its detection of the breach on November 21, when Clop added UoPX to its data leak site.
UoPX is a private for-profit university based in Phoenix, Arizona, with over 100,000 enrolled students and nearly 3,000 academic staff. The breach has raised concerns about the security of personal information, as the attackers accessed names, contact information, dates of birth, social security numbers, and bank account details. In response, UoPX has begun notifying affected individuals and regulatory entities, as required by law.
The Clop ransomware gang has previously targeted other U.S. universities, including Harvard University and the University of Pennsylvania, using similar tactics to exploit vulnerabilities in Oracle EBS platforms. This incident is part of a broader trend of cyberattacks on educational institutions, which have become increasingly vulnerable to such threats.
In light of the breach, UoPX is offering free identity protection services, which include a $1 million fraud reimbursement policy, 12 months of credit monitoring, identity theft recovery, and dark web monitoring. These measures aim to mitigate the risks faced by those whose data was compromised.
The U.S. Department of State has issued a $10 million reward for information linking the Clop ransomware gang’s activities to a foreign government, reflecting the seriousness of the threat posed by this group. As cyberattacks continue to evolve, organizations must remain vigilant and proactive in safeguarding sensitive information.
Key Takeaways
- Monitor your financial accounts for any unauthorized transactions, especially if you are a UoPX student or staff member.
- Consider enrolling in identity protection services offered by UoPX to safeguard your personal information.
- Review your privacy settings on online accounts to enhance security against potential breaches.
- Be cautious of phishing attempts that may arise following this breach, as attackers often exploit such incidents.
- Stay informed about updates from UoPX regarding the breach and any further protective measures they may implement.
Key Terms & Concepts
- Clop ransomware gang: In this article, the Clop ransomware gang refers to a cybercriminal group known for exploiting vulnerabilities to steal sensitive data.
- zero-day vulnerability: A zero-day vulnerability is a security flaw that is exploited by attackers before the vendor has released a fix.
- Oracle E-Business Suite: Oracle E-Business Suite is a set of integrated business applications used for financial and operational management.
- CVE-2025-61882: CVE-2025-61882 is the identifier for the specific zero-day vulnerability exploited in the University of Phoenix breach.
Read the original article here: https://www.bleepingcomputer.com/news/security/university-of-phoenix-data-breach-impacts-nearly-35-million-individuals/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
