A hacker took over NYU’s website for at least two hours Saturday morning to expose over 3 million applicants’ names, test scores, majors and zip codes, as well as information related to family members and financial aid dating back to at least 1989.
The university’s website was restored at around noon. The hacked page displayed three charts with what the group claims to be NYU’s average admitted SAT scores, ACT scores and GPAs for the 2024-25 admissions cycle. The group argued that despite the Supreme Court’s takedown of affirmative action in 2023, “NYU continued anyway,” showing that the average admitted test scores and GPAs for Asian and white applicants were higher than those who identify as Hispanic or Black.
The page, first reported by a user on Reddit at around 10:30 a.m., included four accessible CSV files revealing NYU admissions data since at least 1989, including over 3 million admitted students’ applications, demographic data, city and zip codes, and citizenship status. The files also show Common Application data, which includes details of financial aid, rejected students, how many students applied Early Decision and personal information about siblings and parents.
-
The hacked page revealed charts allegedly detailing standardized test scores and GPAs of admits for the 2024-25 application cycle.
-
In a statement to WSN at around 2 p.m., NYU spokesperson John Beckman said the university’s IT team responded to “malicious hackers” immediately and the redirected webpage “has been brought to a halt.”
“The university reported the hack to law enforcement, is taking steps to make sure the attackers are out of our systems, and is reviewing the university’s systems to bolster their security,” Beckman said.
In July 2023, an online group who went by the same pseudonym, “Computer Niggy Exploitation,” leaked more than 7 million social security numbers by hacking the University of Minnesota’s admissions records since 1989, in a similar attempt to compare students’ racial demographics to their test scores. Two alumni whose data had been leaked filed a class-action lawsuit against the university later that year, arguing that the breach could have been prevented and that its failure to protect personal information violates the Minnesota Government Data Practices Act.
Other major universities have been victim to data breaches and leaks in the last few years. In 2019, some Stanford University students’ SSNs, home addresses, citizenship status and standardized test scores were available through Common Application and high school data leaks. In October 2024, a data breach at Georgetown University exposed students’ and graduates’ financial aid information, social security numbers, GPAs, admissions details and visa information.
In July 2023, NYU issued a statement condemning the Supreme Court’s affirmative action ruling as a “step backwards.” Admissions data released last October showed a significant drop in historically underrepresented minority groups — namely students who identify as “Black, Hispanic, Native American and Hawaiian and other Pacific islander” — with Black student enrollment falling to 4% from 7% and Latino student enrollment falling to 10% from 15%. In a corresponding statement, president Linda Mills said the changes were “not unanticipated” but that the university will “continue to innovate on.”
Contact Dharma Niles, Krish Dev and Yezen Saadah at [email protected].
