Where does the New York University case file come from?

Every entry is taken from the breach report New York University lodged with the Oregon Attorney General. Nothing here is estimated.

Why do the incident date and the report date differ?

Companies usually investigate before they report. The gap between the two dates shows how long that took.

What does the records-affected figure count?

It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.

Does this case file change over time?

Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Case file

Case File: New York University Data Breach

This file collects the dated facts on record for the New York University incident. The state report is dated June 9, 2025. The incident itself is dated October 20, 2024.

Timeline

232 days separate the incident date from the date it was reported.

October 20, 2024Incident dateWhen the filing says the breach took place.
June 9, 2025Report filed in OregonDate the notice was lodged with the Oregon Attorney General.

Case facts

Filing state: Oregon
Date reported: June 9, 2025
Incident date: October 20, 2024
Receiving office: Oregon Attorney General

Case notes

New York University has formally reported a data incident to regulators in Oregon, according to public filings. The incident was identified as occurring on October 20, 2024, with the official report submitted on June 9, 2025. The university stated that it is currently investigating the full scope and impact of this event.

The details available from public disclosures do not specify the exact types of personal information involved in this incident. It is broadly described as a data event affecting information held by New York University.

While the specific information is not detailed in the public filing, individuals who receive notification directly from New York University should carefully review that communication for personalized guidance. Such notices typically explain how the incident may affect them and provide specific recommendations.

In general, it is prudent for anyone notified of a data incident to remain vigilant against potential misuse of their personal information. This includes regularly monitoring financial statements and credit reports for any unusual activity. If suspicious activity is detected, promptly report it to the relevant financial institution or credit bureau.

The information regarding this incident, including the reported dates and investigation status, is based on records filed with state regulatory bodies, which serve as public records of data security incidents.

Questions about this case file

Where does the New York University case file come from?: Every entry is taken from the breach report New York University lodged with the Oregon Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?: Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?: It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?: Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Oregon data breaches

Filing source: Oregon Attorney General

Named in the New York University breach?

Attach your notice and a short note. An attorney checks it against this case file at no cost.

Timeline

Case facts

Case notes

Questions about this case file

More Oregon case files