Albany College hack exposes nearly 29K individuals

Hackers breached the Albany College of Pharmacy and Health Sciences (ACPHS) last year, stealing a large amount of sensitive information.

ACPHS started sending out breach notification letters to tens of thousands of individuals impacted by the September 2024 data breach. According to information the college submitted to the Maine Attorney General’s Office, 28,600 were impacted by the attack.

After ACPHS discovered a breach of its systems, an investigation into the incident was launched. The postmortem, led by a third-party cybersecurity firm, revealed that attackers roamed the college’s systems for roughly two weeks from the end of August until the discovery of the breach in mid-September.

According to a notice, published on the college’s website, attackers took virtually every piece of personal information it’s possible to collect about a person:

• First and last names
• Dates of birth
• Birth certificates
• Account numbers
• Routing numbers
• Security codes
• Marriage certificates
• Mother's maiden name
• Digital signatures
• Passport numbers
• Government identification numbers
• Social Security numbers (SSNs)
• Taxpayer ID numbers
• Driver's license numbers
• Payment card numbers
• Payment card expiration dates
• Alien registration numbers
• Usernames and passwords
• Health insurance information
• Medical information (including medical record number, mental or physical condition, diagnosis/treatment information, procedure type, provider name, prescription information, biometric data)
• Student information

Interestingly, the data breach notice ACPHS submitted to the Maine Attorney General’s Office has the details about the leaked information redacted. However, if attackers had access to data the college said was taken in its data security notice, there would be numerous dangers to exposed individuals.

There’s enough information for identity theft, financial fraud, account takeovers, and medical identity theft. Attackers could try to apply for fraudulent bank services, file fraudulent tax returns, or submit fake medical claims to obtain prescription drugs.

While the breach notification letter claims that ACPHS has “no evidence that any of the information has been misused,” the college will provide impacted individuals with identity protection services.

Founded in the late 19th century, ACPHS currently has around 900 students under its roof, with over 100 faculty members.