Bennett College Discloses Breach Affecting More Than 30,000 People

Key Takeaways

• Bennett College reported unauthorized activity occurred between Oct. 27 and Nov. 15, 2025.
• More than 30,000 people were affected, including nearly 11,000 North Carolina residents.
• The incident highlights the security and budget pressures facing smaller higher-education institutions.

Bennett College has disclosed a dark web-related data breach affecting more than 30,000 individuals, adding the Greensboro institution to a growing list of colleges confronting the theft and potential sale of sensitive personal information.

The unauthorized activity occurred over roughly 20 days, between Oct. 27 and Nov. 15, 2025. Nearly 11,000 of those affected are North Carolina residents, according to FOX8 WGHP, which reported the disclosure on Sept. 4, 2026. The available information does not establish that ransomware was used in the Bennett College incident, although ransomware and data-extortion campaigns remain common across the education sector.

Bennett College stated it secured its systems, enhanced network security, and notified law enforcement, while also offering credit monitoring and identity-protection services to potentially affected individuals. These measures follow standard incident response protocols: contain unauthorized access, investigate the scope, notify relevant authorities, and help users monitor for subsequent fraud.

Stolen records can remain valuable well after affected systems have been secured, particularly when they include Social Security numbers, financial information, or other personally identifiable information. Dark web marketplaces allow such data to be packaged, resold, and combined with information obtained from unrelated breaches, extending risk far beyond the original intrusion.

Colleges hold unusually broad collections of data. Admissions, financial aid, payroll, alumni relations, healthcare, and campus operations each involve different systems and record-retention practices. Users also change frequently as students enroll, graduate, or transfer and employees join or leave. The result is a large identity-management burden, often spread across legacy applications and third-party services.

Smaller colleges can face an especially difficult tradeoff. Bennett College and similarly sized institutions often navigate restricted budgets and smaller IT teams, making around-the-clock monitoring, vulnerability management, and rapid investigation harder to sustain. Despite fewer resources than large universities, smaller colleges remain attractive targets for threat actors seeking valuable financial and identity records.

A 2026 outlook cited by the National Law Review reported a 63% worldwide increase in cyberattacks against the education sector between November 2024 and October 2025. The study found that 91% of higher-education institutions had experienced a breach or attack during the preceding 12 months.

Ransomware remains central to this trend. SC Media reported Comparitech findings that identified 251 ransomware attacks against educational institutions globally in 2025, compared with 247 in 2024. The number of breached records rose 27% to 3.96 million. A separate 2026 estimate put the global average education-sector ransom demand during 2025 at approximately $464,000. Even when no payment occurs, investigation, restoration, legal review, and notification impose substantial costs.

To mitigate these threats, administrators frequently prioritize identity management. Multifactor authentication, privileged-access controls, timely account removal, and regular access reviews reduce exposure. Network segmentation limits lateral movement during an intrusion, while tested offline backups improve recovery options. Endpoint monitoring and centralized logging help teams identify suspicious behavior before an incident expands.

Bennett College and other resource-constrained institutions often use managed security providers or incident-response specialists such as CrowdStrike, Palo Alto Networks, and Kroll to supplement internal teams. These arrangements operate most effectively when responsibilities, escalation paths, and evidence-retention procedures are established before a crisis.

Defense strategies in higher education are increasingly aligned to structured guidance such as NIST Cybersecurity Framework 2.0 (2024) and NIST SP 800-53 Rev. 5 (2020) for access control and data protection. Implementing these frameworks helps institutions balance improved security controls with the open, distributed technology environments that academic communities require.