Academic records leaked: what it means and what to do
Risk level: medium. Can you change it: no. Found in 3 breaches in this directory.
What this data is
Transcripts, enrolment history, course lists, student numbers and graduation dates held by a school, university or online learning platform. Some records also carry disciplinary notes and fee status.
The risk on its own
A transcript on its own is not money, but it is a rich identity document. It usually pins down your full name, your student ID, where you were and in which years, which is exactly the material used to answer identity questions. Old student portals are also notorious for weak passwords that people still reuse.
The risk combined with other data
Put next to your date of birth and address it produces a convincing biography of a real person. Fraudsters use that to open accounts in your name and to pass the knowledge based checks lenders still run. Recruiters and scammers alike can also use it to impersonate you in job applications.
How criminals use it
A scammer calls pretending to be the alumni office, quotes your student number and degree year, then asks you to confirm bank details for a refund.
Someone applies for a job or a visa using your qualifications, because they have the institution, dates and student ID to make the claim stick.
Fake diploma sellers use real enrolment records to produce forged certificates that survive a casual check.
An attacker resets your student email, which is often still linked to cloud storage and old personal accounts.
What to do now
Sign in to the student or alumni portal and change the password, then delete any saved payment card in the profile.
Turn on two-factor authentication on the student email account, and move anything personal out of it.
Ask the registrar in writing which fields were in the breach and whether your student number can be reissued.
Check whether that student email is the recovery address on any personal account, and replace it if it is.
Treat any call about fees, refunds or graduation admin as unverified until you ring the institution on its published number.
Frequently asked questions
Can someone use my transcript to steal my identity?
Not by itself, but it supplies the biography, full name, institution, dates and student number, that makes an application in your name look researched rather than invented.
The breach is from a university I left years ago. Does it still matter?
Yes. Facts like your degree and graduation year never expire, and old student accounts are often still linked to an email address you use today.
Can I make the institution delete my records?
Usually not entirely, because academic records are kept for legal and verification reasons, but you can ask for marketing and alumni profiles to be deleted and for the account itself to be closed.
Breaches that exposed this data
Houston City College: 2026-06-16, 832K accounts, Academic records, Citizenship statuses, Dates of birth, Email addresses, Genders, Names
Glendale Community College: 2026-06-15, 794K accounts, Academic records, Dates of birth, Email addresses, Genders, Government issued IDs, Names
University of Nottingham: 2026-06-09, 455K accounts, Academic records, Citizenship statuses, Dates of birth, Disabilities, Email addresses, Ethnicities
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.