University of Phoenix data breach impacts nearly 3.5 million individuals

The Clop ransomware gang has stolen the data of nearly 3.5 million University of Phoenix (UoPX) students, staff, and suppliers after breaching the university's network in August. Headquartered in Phoenix, Arizona, UoPX is a private for-profit university founded in 1976 with 82,700 enrolled students and 3,400 employees (nearly 2,300 academic staff). In early December, the university disclosed the incident on its official website, and Phoenix Education Partners, its parent company, filed an 8-K with the U.S. Securities and Exchange Commission (SEC). UoPX said it detected the breach on November 21 (after Clop added it to its data leak site), noting that the attackers exploited a zero-day vulnerability in the Oracle E-Business Suite (EBS) financial application to steal sensitive personal and financial information belonging to staff, suppliers, and current and former students. "We believe that the unauthorized third-party obtained certain personal information, including names and contact information, dates of birth, social security numbers, and bank account and routing numbers with respect to numerous current and former students, employees, faculty and suppliers was accessed without authorization," the school stated. Andrea Smiley, the university's Vice President for Public Relations, told BleepingComputer at the time that UoPX was "reviewing the impacted data and will provide the required notifications to affected individuals and regulatory entities." On Monday, the school revea...