On November 21, 2025, the University of Phoenix learned it had been affected by the Oracle E-Business Suite vulnerability that Clop threat actors had been exploiting to exfiltrate data between August 13, and August 22, 2025.
The incident involved personal information for 3,489,274 people nationwide, as reported to the Maine Attorney General’s Office on December 21. The types of information involved included names, dates of birth, Social Security numbers, and bank account and routing numbers (reportedly without means to access).
Notification letters sent on December 22 to those affected offer complimentary identity protection
services, including 12 months of credit monitoring, dark web monitoring, $1 million identity fraud
loss reimbursement policy, and fully managed identity theft recovery services.
