Worcester State University Data Breach Notification
Summary
Worcester State University issued a data breach notification letter on February 25, 2026, detailing a breach that exposed personal information of students and staff from January 24 to February 2, 2026. The university has updated its policies to prevent future incidents and is providing guidance on security freezes.
What changed
Worcester State University has issued a data breach notification letter dated February 25, 2026, concerning a breach that occurred between January 24 and February 2, 2026. The exposed personal information included driver's license numbers, social security numbers, names, dates of birth, sex, and height. The university has collected and destroyed exposed materials and has reviewed and updated its policies regarding communications between University Police and Residence Hall staff to prevent future exposure of personally identifiable information.
Regulated entities, particularly educational institutions, should review their data security and incident response protocols. While this is a notification of a past event, it highlights the importance of robust data protection measures. Consumers affected by this breach are advised to place security freezes on their credit reports with Equifax, Experian, and TransUnion, and are provided with contact information and required documentation for this process.
What to do next
- Review data security and incident response protocols.
- Ensure personally identifiable information (PII) is excluded from inter-departmental communications where not strictly necessary.
- Provide affected individuals with clear guidance on protective measures such as security freezes.
Source document (simplified)
The seal of Worcester State University, featuring a circular border with the text "WORCESTER STATE UNIVERSITY" and "1874". In the center, there is a depiction of a building with a dome, likely a university hall.
Worcester State University seal
WORCESTER
STATE
UNIVERSITY
Vice President, Division of Administration and Finance
Phone: 508-929-8087
Fax: 508-929-8433
February 25, 2026
A solid black rectangular box used to redact information, likely a name or address, in the header of the letter.
Redacted area
We are writing to notify you that a public posting of your personal information occurred on January 24, 2026 through February 2, 2026 at Worcester State University. Information exposed included your driver's license number, social security number, name, DOB, sex and height along with a photo. I have been informed that all materials exposing these details have been collected from campus and destroyed. In response to this incident the university has reviewed, evaluated and updated its policy and procedures surrounding communications between University Police and Residence Hall staff to ensure measures are taken to exclude any personal identifiable information when there is a need to share information regarding campus visitors.
There is no police report with regard to this matter. However, if you find you are the victim of identity theft, you have the right to file a police report and obtain a copy of it. I understand you have already taken steps to protect your accounts from fraudulent activity, some of which are described below
You may place a security freeze on your credit reports, free of charge. A security freeze prohibits a credit reporting agency from releasing any information from a consumer's credit report without written authorization. However, please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit mortgages, employment, housing or other services. Under federal law, you cannot be charged to place, lift, or remove a security freeze.
You must place your request for a freeze with each of the three major consumer reporting agencies: Equifax (www.equifax.com); Experian (www.experian.com); and TransUnion (www.transunion.com). To place a security freeze on your credit report, you may send a written request by regular, certified or overnight mail at the addresses below. You may also place a security freeze through each of the consumer reporting agencies' websites or over the phone, using the contact information below:
Equifax Security Freeze
P.O. Box 105788
Atlanta, GA 30348
1-800-349-9960
https://www.equifax.com/personal/credit-report-services/
Experian Security Freeze
P.O. Box 9554
Allen, TX 75013
1-888-397-3742
https://www.experian.com/freeze/center.html
TransUnion Security Freeze
P.O. Box 160
Woodlyn, PA 19094
1-888-909-8872
https://www.transunion.com/credit-freeze
In order to request a security freeze, you will need to provide some or all of the following information to the credit reporting agency, depending on whether you do so online, by phone, or by mail:
- Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
- Social Security Number;
- Date of birth;
- If you have moved in the past five (5) years, the addresses where you have lived over the prior five years;
- Proof of current address, such as a current utility bill, telephone bill, rental agreement, or deed;
- A legible photocopy of a government issued identification card (state driver's license or ID card, military identification, etc.);
- Social Security Card, pay stub, or W2;
- If you are a victim of identity theft, include a copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft.
The credit reporting agencies have one (1) to three (3) business days after receiving your request to place a security freeze on your credit report, based upon the method of your request. The credit bureaus must also send written confirmation to you within five (5) business days and provide you with a unique personal identification number (PIN) or password (or both) that can be used by you to authorize the removal or lifting of the security freeze. It is important to maintain this PIN/password in a secure place, as you will need it to lift or remove the security freeze.
To lift the security freeze in order to allow a specific entity or individual access to your credit report, you must make a request to each of the credit reporting agencies by mail, through their website, or by phone (using the contact information above). You must provide proper identification (including name, address, and social security number) and the PIN number or password provided to you when you placed the security freeze, as well as the identities of those entities or individuals you would like to receive your credit report. You may also temporarily lift a security freeze for a specified period of time rather than for a specific entity or individual, using the same contact information above. The credit bureaus have between one (1) hour (for requests made online) and three (3) business days (for request made by mail) after receiving your request to lift the security freeze for those identified entities or for the specified period of time.
To remove the security freeze, you must make a request to each of the credit reporting agencies by mail, through their website, or by phone (using the contact information above). You must provide proper identification (name, address, and social security number) and the PIN number or password provided to you when you placed the security freeze. The credit bureaus have between one (1) hour (for requests made online) and three (3) business days (for requests made by mail) after receiving your request to remove the security freeze.
In response to the breach Worcester State University is providing you with access to 24 months of credit monitoring and identity restoration services through Equifax at no charge to you. You must enroll by March 31, 2027. Enclosed with this letter is your Equifax Complete – Premier activation offer which describes the services available to you. The offer provides an activation code specifically for you and the enrollment deadline, in addition to the enrollment instructions.
You should also consider placing fraud alerts on your credit file; review your credit reports for unexplained activity; and review credit card or other financial accounts for any suspicious and/or unauthorized activity.
We sincerely regret any issue this incident may have caused you. If you have additional questions, please contact me directly at keicheiroth@worcester.edu so that I may assist you.
Sincerely,
A handwritten signature in blue ink that reads "Kathleen Eichelroth".
Kathleen Eichelroth
Vice President for Administration & Finance/CFO
EQUIFAX logo
Equifax Complete™ Premier
*Note: You must be over age 18 with a credit file to take advantage of the product
Key Features
- Annual access to your 3-bureau credit report and VantageScore3 credit scores
- Daily access to your Equifax credit report and 1-bureau VantageScore credit score
- 3-bureau credit monitoring2 with email notifications of key changes to your credit reports
- WebScan notifications3 when your personal information, such as Social Security Number, credit/debit card or bank account numbers are found on fraudulent Internet trading sites
- Automatic fraud alerts4, which encourages potential lenders to take extra steps to verify your identity before extending credit, plus blocked inquiry alerts and Equifax credit report lock5
- Identity Restoration to help restore your identity should you become a victim of identity theft, and a dedicated Identity Restoration Specialist to work on your behalf
- Up to \$1,000,000 of identity theft insurance coverage for certain out of pocket expenses resulting from identity theft6.
- Lost Wallet Assistance if your wallet is lost or stolen, and one-stop assistance in canceling and reissuing credit, debit and personal identification cards.
Enrollment Instructions
Go to www.equifax.com/activate
Enter your unique Activation Code of [REDACTED] then click "Submit" and follow these 4 steps:
1. Register:
Complete the form with your contact information and click "Continue".
If you already have a myEquifax account, click the 'Sign in here' link under the "Let's get started" header.
Once you have successfully signed in, you will skip to the Checkout Page in Step 4
2. Create Account:
Enter your email address, create a password, and accept the terms of use.
3. Verify Identity:
To enroll in your product, we will ask you to complete our identity verification process.
4. Checkout:
Upon successful verification of your identity, you will see the Checkout Page.
Click 'Sign Me Up' to finish enrolling.
You're done!
The confirmation page shows your completed enrollment.
Click "View My Product" to access the product features.
3The credit scores provided are based on the VantageScore® 3.0 model. For three-bureau VantageScore credit scores, data from Equifax®, Experian®, and TransUnion® are used respectively. Any one-bureau VantageScore uses Equifax data. Third parties use many different types of credit scores and are likely to use a different type of credit score to assess your creditworthiness.
2Credit monitoring from Experian and TransUnion will take several days to begin.
3WebScan searches for your Social Security Number, up to 5 passport numbers, up to 6 bank account numbers, up to 6 credit/debit card numbers, up to 6 email addresses, and up to 10 medical ID numbers. WebScan searches thousands of Internet sites where consumers' personal information is suspected of being bought and sold, and regularly adds new sites to the list of those it searches. However, the Internet addresses of these suspected Internet trading sites are not published and frequently change, so there is no guarantee that we are able to locate and search every possible Internet site where consumers' personal information is at risk of being traded.
4The Automatic Fraud Alert feature is made available to consumers by Equifax Information Services LLC and fulfilled on its behalf by Equifax Consumer Services LLC.
5Locking your Equifax credit report will prevent access to it by certain third parties. Locking your Equifax credit report will not prevent access to your credit report at any other credit reporting agency. Entities that may still have access to your Equifax credit report include: companies like Equifax Global Consumer Solutions, which provide you with access to your credit report or credit score, or monitor your credit report as part of a subscription or similar service; companies that provide you with a copy of your credit report or credit score, upon your request; federal, state and local government agencies and courts in certain circumstances; companies using the information in connection with the underwriting of insurance, or for employment, tenant or background screening purposes; companies that have a current account or relationship with you, and collection agencies acting on behalf of those whom you owe; companies that authenticate a consumer's identity for purposes other than granting credit, or for investigating or preventing actual or potential fraud; and companies that wish to make pre-approved offers of credit or insurance to you. To opt out of such pre-approved offers, visit www.optoutprescreen.com
6The Identity Theft Insurance benefit is underwritten and administered by American Bankers Insurance Company of Florida, an Assurant company, under group or blanket policies issued to Equifax, Inc., or its respective affiliates for the benefit of its Members. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions.
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get Government General alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when Massachusetts - Breach Notification Letters (Mar 2026) publishes new changes.