PHOENIX, Jan 5, 2026, 15:03 MST
The University of Phoenix is notifying 3,489,274 people after attackers exploited a previously unknown flaw in Oracle’s E-Business Suite and accessed sensitive personal and financial data, Fox News reported. Security researchers believe the tactics align with the Clop ransomware gang, the outlet said, and it noted Oracle E-Business Suite-related incidents at Harvard University and the University of Pennsylvania. 1
With Social Security numbers and bank account and routing numbers in the mix, victims face a high risk of identity theft and financial fraud. That kind of data can be reused long after a company closes the initial hole.
The case also underlines the exposure created by widely used back-office software, where finance and payroll systems can sit close to other high-value records. When attackers find a way into that plumbing, the haul can be large.
Phoenix Education Partners, the university’s parent, said in a Dec. 2 securities filing that it detected the incident on Nov. 21, 2025 and believes the vulnerability was used in August 2025 to copy data from its Oracle environment. The company said it installed Oracle patches after they were released in October and said the incident did not disrupt business operations or student programs. 2
Cybercrime site The420.in separately reported that the breach affected students, alumni, faculty and staff, as well as some external partners, after the attackers listed the university on a public leak site. 3
A “zero-day” vulnerability refers to a security flaw that is unknown to the vendor at the time attackers begin exploiting it, leaving defenders with little warning. Oracle’s E-Business Suite is a back-office platform used for functions such as financial operations.
Separately, the University of Phoenix on Monday released a white paper titled “Untapped Potential: How Credit for Prior Learning Can Redefine Employer Outlook on Professional Development,” authored by Devin Andrews, its vice president of admissions and evaluation. It described “credit for prior learning” — academic credit for relevant learning outside the classroom, including work experience and training — as a lever to improve internal mobility and retention, and cited a Harris Poll survey of 610 human-resources managers and 1,195 employees. “Credit for prior learning is one way we say to them, what you already know counts,” Andrews said. 4
Credit for prior learning has become a growing feature in adult-focused programs as schools and employers look for shorter, cheaper paths to credentials. The approach can shorten time to graduation, but it depends on consistent evaluation standards and employer buy-in.
The breach investigation is ongoing, and the outcome will hinge on whether the stolen data is later published or misused. If that happens, the costs for notification, monitoring, potential litigation and regulatory scrutiny could rise, and affected individuals may face sustained fraud risks.
