Southern Illinois University Data Breach Notice (California Attorney General)

The letter from Southern Illinois University has arrived. It confirms that your personal information was included in a data incident the university disclosed to the California Attorney General. No passwords, no login credentials, and no permanent government identifiers beyond what the filing lists were exposed. The record states that the number of people affected is not disclosed.

If you received that notification, your name, address, and other personal details the university held are now known to have been exposed. That exposure cannot be undone. The information retains value for identity thieves and fraudsters long after the initial breach because it can be combined with data from other sources to build convincing profiles for new account fraud, tax refund theft, or medical identity misuse.

What the Filing Actually Lists

The California Attorney General filing names only personal information as defined under breach notification law. It does not list Social Security numbers, driver’s license numbers, financial account details, medical records, or any other specific subcategory beyond the broad legal definition of personal information. No passwords were exposed. The university has not disclosed the exact mix of data fields that applied to each individual.

This matters because the absence of certain high-risk identifiers changes the immediate threat picture. Without a Social Security number attached to your record in this incident, the classic “IRS impersonation” or “tax fraud” playbook that relies on an SSN is not directly enabled by this breach alone. That is genuine good news relative to many university breaches. However, the combination of your name with address, date of birth, or contact details still provides a foundation that criminals can build upon over years.