University of Minnesota investigates claim that 7 million records were stolen

The University of Minnesota said in August 2023 that it was investigating a claim by an unnamed hacker who said they had taken a large university database, including around 7 million Social Security numbers belonging to alumni and others.

The university learned of the claim on July 21, 2023 and hired an outside firm to investigate. Administrators did not confirm the attacker's figures and said the incident had not disrupted campus operations. Local coverage reported that the records at issue reached back to 1989.

The Minnesota Bureau of Criminal Apprehension opened an investigation, and the FBI's Minneapolis office said it was aware of the situation. Mark Lanterman, chief technology officer at Computer Forensic Services, asked Fox 9 why records going back to 1989 were held on a system reachable from the internet, and said people should freeze their credit. A university alumnus quoted in the same report said the breach was a reminder to use multi-factor authentication.

As the investigation progressed, the university said the affected data warehouse held information drawn from financial aid applications spanning 1989 to 2021, including dates of birth, Social Security numbers and passport information. By late September 2023 it had begun notifying roughly 2 million individuals, with a university spokesperson saying it was contacting everyone identified with any data element in the warehouse rather than only those confirmed to be affected. Several lawsuits were filed against the institution over the incident.