American Campus Communities experienced a data breach involving current and former employee information. The incident came to light after the threat actor known as Helix claimed responsibility on October 19, 2026, alleging that millions of records had been stolen and published on the dark web. On October 30, 2026, the company disclosed the incident to state regulators, including the Attorneys General of Texas and Massachusetts.
The compromised records included full names, mailing addresses, Social Security numbers, driver's license numbers, government-issued identification numbers, financial account details, payment card numbers, medical information, and health insurance information. Formal breach filings indicated that at least 252 residents were affected in Texas, while secondary tracker data recorded 699 total individuals impacted. An authoritative nationwide total has not been confirmed.
Notices were mailed to affected individuals offering credit monitoring and identity protection services. Investigation into the incident remains active as regulatory filings continue to be evaluated and further details may emerge.