Mercer University data breach impacted over 93,000 students & others

Georgia-based Mercer University suffered a major data breach incident in April that compromised the sensitive personal information of thousands of students and faculty members.

Based in Macon, Georgia, Mercer University was established in 1833 and gained university status in 1837, becoming one of the United States’ oldest private research universities. The University today has over 9,000 students enrolled across twelve colleges and schools.

The University said in a data breach notification last week that it identified unauthorised access to its internal systems on April 5. It immediately began investigating the unauthorised intrusion and secured its affected systems. The University also notified law enforcement about the security incident.

According to Mercer University, the investigation revealed that “between February 12, 2023, and February 24, 2023, an unauthorized actor accessed certain files stored on Mercer’s computer servers.

“On April 30, 2023, Mercer discovered that some of these files may have included at least one record that contained the personal information of Maine residents, including their names, in combination with Social Security numbers and/or driver’s license numbers,” the University added.

The cyber attack also forced the University to cancel its National Signing Day event and offer refunds or postpone the start of classes scheduled to begin this week. Most student services were disrupted, including systems for student IDs, parking passes, financial aid, academic advising, registration, bill payment, transcript requests, testing, and disability services.

Though the University did not clarify how threat actors gained access to its internal systems or how many individuals were impacted by the incident, a filing with Maine’s Attorney General revealed that 93,512 individuals were affected by the security incident.

Mercer has started notifying all affected individuals since May 24 and has offered one year of complimentary credit monitoring and identity theft protection services through Experian.

Earlier this month, Chattanooga State Community College, which serves over 11,000 students in the US state of Tennessee, also reported a cyberattack that forced the school to cancel classes and change staff schedules.