Hacker Breaks into NYU Website, Publishes Data on SAT, ACT and GPA Scores

A hacker claimed responsibility for hacking the New York University's website and reportedly publishing the SAT, ACT and GPA scores for the 2024 students. 

The hacker's purported goal was to "expose" NYU's illegal admission practices, but in so doing so, exposed the personal information of more than 3 million applicants. 

NYU's Steinhardt School of Culture, Education, and Human Development page was the one compromised. According to a report from a Reddit user, visitors were met with a list of student names and their academic scores. The hacker claimed responsibility on X, where he also said he's responsible for a University of Minnesota hack that happened a couple of years ago. 

"Thank you friend. I also did the same thing to University of Minnesota a couple of years ago. There's a lot more data from their data warehouse that could be analyzed further, I only posted (redacted) bare minimum to prove they're breaking the law."

NYU has since taken the page down and issued a statement acknowledging the breach. 

"The university is actively investigating the incident and is working with appropriate authorities to determine the full scope of the breach," said an NYU spokesperson to Washington Square News.

Hackers didn't need much

According to the hacker's statements, the breach didn't require advanced techniques. Instead, existing vulnerabilities in the university's content management system that had reportedly gone unpatched were exploited in the attacks. 

NYU says that the hack includes a lot more information than what was displayed, including applicants' names, test scores, majors and zip codes. Data regarding financial aid for students and family members was also compromised. 

NYU has begun notifying affected students and has bolstered its internal security systems. The publication of academic records—considered protected educational information under FERPA (Family Educational Rights and Privacy Act)—might have unknown consequences for the students. 

It’s not yet clear whether the authorities are investigating the cybersecurity incident. Meanwhile, students and faculty are urging the university to audit its IT infrastructure comprehensively.