NYU Breach

On March 22, 2025, New York University (NYU) experienced a significant cybersecurity breach when its official website was compromised for over two hours. During this time, the homepage was replaced with a black background displaying green text, including charts of SAT, ACT scores, and GPAs divided by race, along with a racial epithet. The hacker, identified as "@bestn-gy" on X, claimed responsibility, stating that the data was sourced from NYU's data warehouse and alleging that NYU continued racial affirmative action despite it being ruled illegal in 2023 . 

The breach exposed personal information of over 3 million applicants, including names, test scores, majors, and zip codes, dating back to at least 1978 across all schools. The hacker also displayed charts claiming to show the university’s average admitted SAT scores, ACT scores, and GPAs for the 2024-25 admissions cycle, arguing that NYU has continued to use race-sensitive admissions despite the Supreme Court’s takedown of affirmative action in 2023 . 

NYU's response to the breach has been met with criticism. In a university-wide email sent about six hours after the breach, senior administrators stated that NYU removed the hacked page and reported the incident to law enforcement. Five days later, they characterized the charts included on the university’s website as “inaccurate and misleading,” asserting that NYU “scrupulously complies with the law” regarding race-sensitive admissions. However, the university did not clarify what about the graphs or information the hacker presented was inaccurate. 

The breach has led to at least 10 class action lawsuits against NYU, alleging that the university mishandled applicants’ personal information and failed to meet national cybersecurity standards. The lawsuits claim that NYU’s cybersecurity practices do not follow guidelines set by the National Institute of Standards and Technology and the Center for Internet Security, leaving applicants at risk of identity theft .