Kaplan data breach exposes personal information of more than 230,000 people

Kaplan, a Florida-based educational services company, disclosed that at least 230,000 individuals had sensitive personal information exposed in a cybersecurity incident that occurred between late October and mid-November 2025, prompting regulatory filings in multiple states and sparking legal action.

The company notified state regulators last week that hackers accessed its servers from Oct. 30 through Nov. 18, 2025. During that period, unauthorized actors obtained files containing names, Social Security numbers and driver’s license numbers. Law enforcement authorities were contacted after the breach was detected, and an internal investigation confirmed that data had been taken.

Kaplan submitted breach notification letters in at least seven states but has not publicly confirmed the total number of affected individuals. State-level disclosures indicate that 230,941 people were impacted. The largest number of affected individuals was reported in Texas, with 173,676 cases, followed by South Carolina with approximately 26,600, Maine with 19,075 and New Hampshire with more than 11,600.

No hacking group has claimed responsibility for the intrusion.

Kaplan provides educational services and test preparation programs, including widely used courses for high school students preparing for the SAT and ACT, as well as graduate-level exam preparation for medical, law and business schools. The company serves approximately 1.2 million students and operates in 27 countries. It also delivers employee development programs to more than 15,000 corporate clients.

The company is owned by Graham Holdings, a diversified holding company that reported $4.9 billion in revenue last year.

Legal fallout has begun following the breach. Wolf Haldenstein Adler Freeman & Herz LLP, a national consumer rights law firm, has opened an investigation into potential claims on behalf of affected individuals. Several class-action lawsuits related to the incident have also been initiated.

Kaplan has begun notifying individuals whose information may have been compromised, warning that stolen data could be misused or offered for sale online.