Tulane University

Summary

Tulane University experienced unauthorized access to its Oracle E-Business Suite system through a zero-day vulnerability, allowing attackers to obtain files containing names, Social Security numbers, direct deposit details, and banking information. The breach was identified after an internal investigation, prompting the involvement of law enforcement and the application of security patches. Affected individuals face heightened risk of identity theft and fraud, leading a national class action law firm to investigate potential legal claims on their behalf.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On August 10, 2025, Tulane University experienced unauthorized access to certain files through a zero-day vulnerability in Oracle's E‑Business Suite, a platform the university uses to store human resources data. Upon discovering the activity, Tulane initiated an internal investigation, engaged law enforcement authorities, and applied the security patches released by Oracle to address the vulnerability. The university continued its assessment over the following months, working to determine the scope and nature of the intrusion. On March 12, 2026, Tulane University announced that its investigation had confirmed that unauthorized persons had exploited the zero‑day flaw on August 10, 2025 to access system files containing personal information. The disclosure marked the formal acknowledgment of the breach to affected individuals and regulators.

The exposed data included names, Social Security numbers, direct deposit details, and banking information associated with the university’s human resources records. Individuals who received a data breach notification from Tulane were advised that their personal information could be used for identity theft and fraud, representing the primary impact of the incident. In response to the breach, Edelson Lechtzin LLP announced that it is investigating a potential class action on behalf of those whose data may have been compromised. Tulane’s response actions also comprised the ongoing cooperation with law enforcement, the remediation of the vulnerable Oracle system, and the notification process to inform affected parties. These steps constitute the factual chronology, scope of exposed information, and the measures taken by the university and legal entities following the discovery of the breach.

Sources

Sources available to members: 1 source.