On December 2, 2025, Phoenix Education Partners, Inc., the parent company of Phoenix University, made a Form 8-K filing with the SEC about a data breach they detected on November 21, 2025.  The attack involved the CVE-2025061882 vulnerability that affected specific versions of the Oracle E-Business Suite. This known vulnerability allowed unauthorized remote access via the HTTP protocol, leading to compromises across multiple Oracle environments, including those of other major educational institutions such as Harvard and Dartmouth.

It is believed that the attack occurred as early as August, three months before Phoenix University teams discovered it, and it affected 3.5 million individuals, including former students, applicants, employees, faculty, and vendor suppliers. Compromised data included full names, contact information, birth dates, Social Security numbers (SSNs), and some banking information. The university began broad notification of the incident on December 22, 2025.

 

Basis of the Data Breach Case

An Illinois resident has brought legal action against Phoenix Education Partners and Oracle. While the University installed Oracle’s remediation patches shortly after their release in October 2025, the plaintiff alleges the school failed to implement reasonable data security for its Oracle E-Business Suite environment in the period leading up to the breach. In addition, the suit also asserts that:

  • Phoenix Education Partners and Oracle should reasonably have been aware of critical security flaws in the Oracle EBS/WebLogic infrastructure at the time of the incident
  • The institution maintained highly sensitive information without sufficient encryption, network segmentation, access restrictions, or surveillance systems, allowing large-scale data theft once attackers established initial access
  • Phoenix University did not limit access to financial and identity information based on least-privilege principles and failed to perform appropriate security evaluations and risk analyses
  • The defendants did not employ security protocols aligned with recognized industry practices
  • The institution did not deliver prompt and clear notification to affected individuals

Call to Action

While the University of Phoenix appears to have applied Oracle’s security patch promptly, patching alone is only one layer of an effective cybersecurity program that incorporates many security tasks. Because the attackers remained inside the University’s internal systems for up to three months without detection, proper monitoring and threat hunting would have alerted security teams to their presence much sooner. Real-time alerting for unusual incidents such as abnormal file exports and large data transfers should trigger immediate investigation and containment.

Network segmentation would have placed the Oracle systems in an isolated network zone with restricted lateral movement and limited outbound internet access. Granular segmentation designed around the principle of least privilege (PoLP) makes it more difficult for unauthorized parties to exfiltrate data at scale.

Given the long history of critical vulnerabilities affecting ERP and Oracle platforms, the University should be running regular tabletop exercises focused specifically on Oracle-centric attack scenarios. These exercises should validate that the incident response plan (IRP) includes clear, tested playbooks for zero-day exploitation against core business systems, outlining rapid isolation steps, log review procedures, and incident escalation.

 

Review Your Risk and Security Posture

 

Cybersecurity for Education Institutions or Organizations

How is AI (artificial intelligence) transforming cybersecurity risk in the education industry?