Bennett College Data Breach Lawsuit Investigation
Received an August 2026 breach notice from Bennett College?
Dapeer Law, P.A. is investigating a potential class action against Bennett College, a private liberal arts college in Greensboro, North Carolina, on behalf of students, employees, and other individuals whose personal information may have been exposed in a network intrusion that the college has disclosed in notice letters dated August 28, 2026.
Who may qualify
You may be eligible to participate in a class action if any of the following applies:
- You received a data breach notification letter from Bennett College dated August 2026.
- Your letter offered enrollment in free Cyberscout credit monitoring, a TransUnion service, for 12 months at no cost to you.
- You had personal, financial, or medical information held by Bennett College in its capacity as an educational institution and employer, whether as a current or former student, an applicant, an employee, or a dependent.
- No proof of harm required to consult with counsel. You do not need to have already suffered identity theft to explore your legal options.
- Excluded: individuals who did not receive a breach notice and whose information was not involved in the incident.
Not sure if you qualify?
Send us your notice, we'll confirm your eligibility at no cost.
What happened
Bennett College has reported that it experienced a network disruption affecting certain of its systems between October 27 and November 15, 2025. The college states that it discovered the activity on November 15, 2025, isolated the affected systems, notified law enforcement, and retained outside computer forensic specialists to determine what happened and what information may have been accessed. Notice letters to affected individuals are dated August 28, 2026, and sample notices have been posted by the California Attorney General's Office and the Massachusetts Attorney General's Office.
According to the information reported to regulators, the review of the affected files was not completed until July 9, 2026, roughly eight months after discovery, after which the college gathered updated contact information so that letters could be mailed. Approximately 599 individuals have been notified, reported as 460 Texas residents and 139 Massachusetts residents, and the sample notice text also references 18 Rhode Island residents. The categories of information reported differ by state. For Texas residents, the reported categories include name, Social Security number, driver's license number, address, credit or debit card or other financial account number, health insurance information, and medical information. For Massachusetts residents, the reported category is first and last name. Bennett College is offering 12 months of complimentary credit monitoring through Cyberscout, a TransUnion company, with enrollment required within 90 days of the date printed on the letter.
The combination of a Social Security number, a driver's license number, and a financial account number in a single record is among the most damaging data sets an institution can lose, because a Social Security number cannot be reissued on request the way a card number can, and it supports new account fraud, tax refund fraud, and fraudulent benefit claims for years after a breach. The reported inclusion of health insurance information and medical information raises separate questions about how a college came to hold clinical or insurance records and what safeguards applied to them. How the intruder obtained access, whether the network was encrypted or segmented, whether data was exfiltrated or published, why a nine month gap separated discovery from notification, and whether 12 months of single bureau monitoring is adequate for information of this sensitivity are among the questions being evaluated.
What to do if you received a letter
Keep your notice letter
Do not discard it. Your letter contains the unique enrollment code for the credit monitoring offer, states which categories of your information were involved, and is important evidence if you decide to participate in a lawsuit.
Enroll in the free 12-month credit monitoring
Enroll in the Cyberscout (TransUnion) monitoring offered in your letter within 90 days of the date on the notice, at bfs.cyberscout.com/activate, using the unique code printed in the letter. Accepting this benefit does not waive your right to pursue legal action.
Place a fraud alert or credit freeze
Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze on your file. Request a free weekly credit report from AnnualCreditReport.com, and use the FTC's IdentityTheft.gov recovery guide. Because a Social Security number and a driver's license number were reported as involved for some recipients, also consider requesting an IRS Identity Protection PIN, reviewing your Social Security earnings statement for employment you do not recognize, and asking your state motor vehicle agency about a license number change if you see signs of misuse.
Speak with a data breach attorney
Consultations with Dapeer Law are free and confidential. We'll review your notice, explain your options, and advise whether you may be eligible to join a class action.
Submit your notice for a free review
Two minutes online. A licensed attorney reviews every submission.
Breach timeline
Compensation you may be entitled to
Out-of-pocket expenses
Credit freezes, identity restoration services, and other costs incurred responding to the breach.
Time spent monitoring
Hours spent reviewing accounts, disputing fraudulent charges, and dealing with identity theft issues.
Identity theft & fraud losses
Unreimbursed funds stolen from accounts, unauthorized credit lines, fraudulent credit accounts, tax filings, or medical claims submitted in your name, or tax refund fraud tied to the breach.
Statutory damages
Certain state data breach and consumer protection statutes provide for fixed damages regardless of actual loss.
Injunctive relief
Court orders requiring Bennett College to implement stronger data security practices going forward, including tighter controls over the Social Security numbers, driver's license numbers, and medical and insurance records it retains.
Compensation categories depend on applicable state law, the types of data exposed, and documented losses. No recovery is guaranteed.
Common questions
I received a data breach letter from Bennett College. What should I do? +
Keep the letter. Enroll in the free 12-month Cyberscout credit monitoring within 90 days of the date on your notice, using the code in the letter at bfs.cyberscout.com/activate or by calling the assistance line at 1-866-899-7220. Order your free credit reports at AnnualCreditReport.com or by calling 1-877-322-8228, and consider placing a security freeze or a fraud alert with Equifax, Experian, and TransUnion. A freeze is free and blocks new credit from being opened in your name without your authorization. If your letter listed a Social Security number, requesting an IRS Identity Protection PIN is also worth considering, and if it listed health insurance or medical information, review any explanation of benefits statements for care you did not receive. If you find fraud, file a police report, keep a copy, and use the FTC's recovery guidance at IdentityTheft.gov or 1-877-438-4338. Accepting credit monitoring does not waive your right to sue.
Am I eligible to join a class action against Bennett College? +
If you received an August 2026 breach notice from Bennett College, you may be eligible for a free case evaluation. Eligibility depends on your state of residence, the categories of your data that were reported as involved, and any losses, fraud, or out-of-pocket costs you have incurred. Because the reported categories differ by state, recipients whose letters listed a Social Security number, a driver's license number, a financial account number, or medical or insurance information generally have the strongest claims. Dapeer Law will review your notice at no cost.
How much money could I receive from a class action lawsuit? +
Data breach class action recoveries vary significantly. Settlements typically range from a few hundred dollars for basic out-of-pocket losses to several thousand dollars for documented identity theft, with class size, damages, and negotiation all affecting the final amount. No payout is guaranteed, and this investigation has not yet resulted in a settlement.
What personal information was exposed in the breach? +
The categories reported to regulators differ by state. For Texas residents, the reported categories are name, Social Security number, driver's license number, address, credit or debit card or other financial account number, health insurance information, and medical information. For Massachusetts residents, the reported category is first and last name. The sample notices posted by the state attorneys general do not itemize the data for every recipient, so your individual letter is the authoritative source for which categories of your information were involved. If you no longer have it, Dapeer Law can help you obtain a copy.
Did Bennett College offer free credit monitoring? +
Yes. Bennett College is offering complimentary credit monitoring through Cyberscout, a TransUnion company, at no cost to notice recipients. The California sample notice describes 12 months of alerts from the date of enrollment, and one version of the notice posted in Massachusetts references 24 months, so the exact term should be confirmed against the letter you received. Enrollment must be completed within 90 days of the date on your letter, at bfs.cyberscout.com/activate, using the unique code printed in the notice. A dedicated assistance line is available at 1-866-899-7220, Monday through Friday, 8 a.m. to 8 p.m. Eastern Time. Enrolling is separate from, and does not waive, your right to pursue a claim.
How many people were affected by the Bennett College breach? +
The regulator filings account for approximately 599 individuals notified, reported as 460 Texas residents and 139 Massachusetts residents, and the sample notice text also references 18 Rhode Island residents. Whether residents of additional states were notified has not been publicly disclosed. This page will be updated as additional information becomes available.
Is there a deadline to take legal action? +
Yes. Statutes of limitations for data breach claims vary by state and legal theory, typically ranging from one to six years. Waiting can permanently bar your claim. Contact us as soon as possible for a free evaluation.
How do I get a copy of the official breach notice? +
Sample notices are posted publicly by the California Attorney General's Office and the Massachusetts Attorney General's Office, both linked in Sources below. If you received a letter but no longer have it, Dapeer Law can assist you in obtaining a copy during your free consultation.
Sources & references
- Official breach notice filing · California Attorney General, Bennett College sample breach notice (PDF)
- Secondary regulator posting · Massachusetts Attorney General, Bennett College breach notice (PDF)
- Company · Bennett College (bennett.edu)
- Credit bureau freezes · Equifax · Experian · TransUnion
- Free weekly credit reports · AnnualCreditReport.com
- Identity theft recovery guide · FTC IdentityTheft.gov
Don't let the deadline decide for you. Submit your claim today.
You only have a limited window to act. Our team will review your notice, explain your options, and tell you whether you may be eligible to recover compensation, at no cost to you.
