Bennett College, a private historically Black college for women in Greensboro, North Carolina, has notified individuals that a network disruption led to unauthorized access to sensitive personal and financial information stored on its systems. The intrusion occurred over several weeks in late 2025 before the college discovered and contained it.
Institutions that collect Social Security numbers, financial account information, and health records take on a responsibility to secure that data, and when that security fails, the people whose information was exposed deserve to understand exactly what happened and what options they have.
Bennett College’s Data Breach Investigation
Bennett College, founded in 1873 and one of only two historically Black colleges for women in the United States, discovered in November 2025 that its computer network had been compromised. According to the college’s own notice, the disruption prompted an immediate investigation: administrators secured the affected systems, enhanced network security, and notified law enforcement. The college also retained third-party computer forensic specialists to determine the scope of the intrusion and to identify exactly which files and records had been accessed.
That forensic review determined that an unauthorized party had access to portions of Bennett College’s network for a defined window in late 2025. Because reviewing a compromised network of this kind involves sorting through potentially years of accumulated student, employee, and financial records, colleges and universities in Bennett’s position often need many months to complete a full accounting of whose information was affected and what categories of data were involved, which is reflected in the gap between when the intrusion was discovered and when notice letters went out to affected individuals.
Educational institutions have become an increasingly common target for this type of attack. Colleges and universities typically maintain centralized databases containing some of the most sensitive categories of personal information that exist: Social Security numbers, financial aid and banking details, health records from campus clinics, and government identification numbers collected during enrollment and employment. That concentration of high-value data, combined with the reality that many schools operate on constrained information-security budgets relative to large corporations, has made higher education a frequent target for ransomware groups and other threat actors seeking data they can sell or use for extortion.
Public reporting following the discovery of the incident indicated that a ransomware group claimed responsibility for accessing Bennett College’s systems in the weeks before the network disruption was detected. Ransomware operators typically combine encryption of a victim’s files with theft of a copy of the underlying data, then threaten to publish or sell the stolen data unless a ransom is paid, meaning that even organizations that restore their systems from backup and never pay a ransom can still have had sensitive files copied and exposed to the attacker before the intrusion was stopped.
Bennett College has stated that it does not have evidence the exposed information has been misused for identity theft or fraud, but the college is nonetheless offering complimentary credit monitoring and identity protection services to individuals whose information was involved. That kind of offer is standard practice after a breach involving Social Security numbers and financial account data, precisely because those two categories of information are the ones most commonly used by fraudsters to open new credit accounts, file fraudulent tax returns, or take out loans in a victim’s name.
The combination of data types reportedly involved in this incident, including Social Security numbers, driver’s license or state identification numbers, financial account information, taxpayer identification numbers, passport numbers, and medical and health insurance information, is broad enough that a single affected individual’s personal and financial identity could be reconstructed by a bad actor with access to the stolen files. That breadth is what distinguishes a network intrusion like this one from a narrower breach limited to, for example, only email addresses or usernames.
When Did This Breach Occur?
Per Bennett College’s notice, unauthorized access to its network occurred between October 27, 2025, and November 15, 2025. The college learned of the network disruption on or around November 15, 2025, and began its investigation immediately, ultimately issuing notice to potentially affected individuals on August 27, 2026.
What Information Was Breached?
Bennett College says the information involved varies by individual but may include names, Social Security numbers, driver’s license or state identification numbers, dates of birth, US alien registration numbers, financial account information, taxpayer identification numbers, passport numbers, digital signatures, medical information, and health insurance information.
What You Can Do
Bennett College is offering complimentary credit monitoring and identity protection services to individuals affected by this incident. In addition to enrolling in any services offered, affected individuals should consider taking the following steps:
- Review account statements, credit reports, and explanation of benefits forms regularly for unfamiliar activity.
- Request a free copy of your credit report from each of the three major credit bureaus at annualcreditreport.com.
- Consider placing a fraud alert or a credit freeze on your credit file with Equifax, Experian, and TransUnion.
- Report any signs of identity theft to the Federal Trade Commission and your state Attorney General.
File a Data Breach Lawsuit Against Bennett College
If your personal information was exposed in the Bennett College data breach, you may be entitled to compensation. Companies and institutions that collect sensitive personal data are expected to take reasonable steps to protect it, and when a breach occurs, those affected often have legal options.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
