Brigham Young University Reports April Data Breach in July, Law Firm Alleges
Brigham Young University (BYU) suffered a data breach in late April that may have exposed the personal data of students and faculty, but waited three months before informing them, a law firm investigating the incident on behalf of potential victims said Friday. Schubert Jonckheer said the school started informing its community "on or around July 23, 2025, which may have violated state and federal laws." Maine and Vermont attorneys general also reported the breach on July 23.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Between April 25 and April 27, an unauthorized actor gained access to files on BYU servers, and the data exposed may have included individuals' names and Social Security numbers, the law firm said. Several other firms, including Federman & Sherwood, Strauss Borrelli and Srourian, are also investigating the breach.
When the Maine AG reported the breach, it said five state residents were impacted. The attached notification letter said the university "immediately secured the involved IT systems and launched an investigation" upon learning of the breach, though it didn't provide a date.
The letter said on July 1, BYU "identified one or more file(s) containing the names and Social Security numbers of five Maine residents," and began mailing notification letters to those five individuals on July 23. It also said the university "has implemented additional measures to enhance the security of its network," to prevent similar incidents in the future.
Vermont's AG attached a different notification letter when it reported the breach. In that letter, BYU offered one year of complimentary credit monitoring and identity theft services.