Education company Kaplan reports data breach impacting more than 230,000

Update at 2:55 p.m. EST on March 24: Kaplan informed regulators in Oregon on Tuesday that 1.4 million people were affected by the breach. 

The educational services company Kaplan told state regulators last week that at least 230,000 people had Social Security and driver’s license numbers leaked following a cybersecurity incident in the fall of 2025.

The Florida-based company filed breach notification letters in at least seven states. Only a select number of states publish the number of people impacted by a data breach, and the amounts disclosed by Kaplan add up to 230,941 affected people. The company said 19,075 people in Maine, about 26,600 in South Carolina, 173,676 in Texas and more than 11,600 in New Hampshire were affected.

The letters sent to victims say law enforcement was called after the incident was discovered and an investigation revealed the hackers had access to Kaplan servers from October 30 to November 18.

Kaplan officials said the hackers “took certain files” that contained names, Social Security numbers and driver’s license numbers. 

No hacking group has come forward to take credit for the incident. 

In a statement to Recorded Future News, Kaplan said their investigation into the breach has been completed. 

“It was determined that an unauthorized third party accessed certain information contained within our network,” a spokesperson said. “We are in the process of sending notice to all individuals whose information was potentially contained in the involved files, in accordance with applicable law.”

Kaplan is best known for its widely used high-school test prep for national exams like the SAT and ACT, serving about 1.2 million students. It also offers services for those taking graduate exams for medical school, law school and business school. 

The company has offices in 27 countries and has expanded into working with more than 15,000 corporate clients on employee development programs. Kaplan is owned by Graham Holdings, which reported $4.9 billion in revenue last year. Several law firms have begun class-action lawsuits related to the incident.