The University of St. Thomas, a private nonprofit university in Houston, Texas, experienced a ransomware attack. The ransomware group INC RANSOM claimed responsibility on August 21, 2025, when it announced on its dark web portal that it had exfiltrated approximately 1.8 terabytes of data. The university notified affected individuals and informed the Texas Attorney General on March 9, 2026. The university is cooperating with law enforcement.
Sensitive data exfiltrated includes names, Social Security numbers, dates of birth, addresses, government-issued ID numbers (passport, state ID cards), driver's license numbers, financial account numbers, credit or debit card numbers, medical information, and health insurance details. The specific number of affected individuals is not publicly known. The breach did not involve a vendor or third-party service provider.
Details about data breaches can emerge over time, and notifications are sometimes delayed.