Desk live·
ForensicPost
Breaches/Education/File 25-1025

Universities Hold Records Decades After Any Relationship Ended

Universities appear across this database as vendors’ customers, as breach victims, and as institutions holding records on people decades after any relationship ended.

Constructed geometry · not a chart of case data
TargetHigher education sector
ActorMultiple
S. Rosler11 min readConfidence: medium2 sources reviewed

Education appears throughout this database: PowerSchool at 25-0105 and the district re-extortion at 25-0507, a university finance system at 25-1012, thirteen million accounts at 26-0414, a childcare group at 25-0926, and three universities in autumn 2025.

The Retention Problem Is Definitional

This desk has argued repeatedly for retention discipline — delete what you no longer need — and recorded the one sector where that runs into legitimate counter-pressure, at 25-0308, because medical records have clinical value for decades.

Education has its own version. A degree must be verifiable indefinitely, so the academic record cannot be deleted. Alumni relations are a legitimate ongoing activity. Research participation records have their own retention obligations.

But a wealth capacity assessment at 25-1024, or event attendance from 1998, is not a record anybody needs to keep. The defensible core is narrow and the retained estate is enormous, and nothing distinguishes them in practice.

And The Population Cannot Leave

A customer stops being a customer. An alumnus is an alumnus for life, whether or not they respond to anything. The corpus filed this at 26-0518 and again at 25-1028.

It joins the absent-consent set the database keeps assembling: crash-report subjects at 25-0612, credit-file subjects at 25-0727, employees at 25-0704, children at 25-0927.

The Sector Is Structurally Under-Defended

Distributed IT across faculties, an academic culture that resists central control for good reasons, budgets allocated against teaching and research, and a support-function estate — advancement, procurement, student services — outside every security programme.

It is the funding argument at 25-1211 with an unusual twist: these are not poor institutions. The money exists and does not flow to the systems that hold the people. Graded medium: this is a synthesis across the database rather than a finding from a source.

This is an analysis file

It synthesises the education incidents recorded in this database. Sources below support the 2025 university cases. Corrections: corrections@forensicpost.com.

Sources
  1. Higher education under siege: the 2025 university data breach crisisBreached.Company
  2. Ivy League universities under siegeGÉANT Security
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary