Kaplan North America LLC, the well-known education and test preparation company, confirmed a data breach that exposed the Social Security numbers, names, and driver’s license numbers of more than 230,000 people across at least five U.S. states. In South Carolina alone, over 26,600 residents were affected. If you have ever used Kaplan’s services, you should check whether your personal data was part of this breach right now.

The unauthorized access happened between October 30, 2025 and November 18, 2025, but Kaplan did not report the incident to the South Carolina Department of Consumer Affairs until March 17, 2026 — nearly five months later. During that gap, affected individuals had no idea their most sensitive personal information may have been circulating in the wrong hands.

What happened in the Kaplan data breach?

Kaplan North America discovered that an unauthorized party gained access to its systems during a roughly three-week window from late October to mid-November 2025. During this period, the intruder was able to access files containing sensitive personal information belonging to current and former customers, students, and employees.

According to reports from WLTX/CBS and The Record, Kaplan activated its incident response plan once the breach was detected, contained the unauthorized access, and notified law enforcement. The company then began the process of determining exactly whose information was compromised and what data was taken.

The breach was officially reported to state regulators in March 2026, and notification letters began going out to affected individuals shortly after. Security Boulevard reported that more than 26,000 South Carolinians were among those notified.

Who is affected by this breach?

The Kaplan breach affected over 230,000 people across at least five states. Here is the breakdown by state based on regulatory filings:

  • Texas — 173,676 people
  • South Carolina — 26,612 people
  • Maine — 19,075 people
  • New Hampshire — 11,653 people
  • Rhode Island — 2,045 people

These numbers reflect only the states where public filings have been made, as of April 2026. The actual total may be higher once all state notifications are complete.

If you used Kaplan for test preparation (SAT, GRE, MCAT, bar exam, real estate licensing, or any other program), attended a Kaplan-affiliated school, or worked for the company, your information could be part of this breach — regardless of which state you live in now.

What data was exposed in the Kaplan breach?

The exposed data includes three categories of highly sensitive personal information:

  • Full names — can be used for targeted phishing and social engineering
  • Social Security numbers (SSNs) — the single most dangerous piece of personal data to have stolen, used for identity theft, fraudulent tax filings, and opening accounts in your name
  • Driver’s license numbers — used for identity verification fraud, fake IDs, and additional identity theft schemes

This is a critical-severity breach. Unlike a breach that only exposes email addresses or passwords, the exposure of Social Security numbers creates long-term risk. SSNs cannot be changed like a password. Once stolen, they can be used to commit fraud for years — even decades — after the original breach.

How can you check if your data was affected?

If you have ever interacted with Kaplan North America in any capacity, take these steps:

Check your mail. Kaplan is sending written notification letters to everyone whose data was confirmed to be part of the breach. If you receive one, take it seriously and follow the instructions immediately.

Check your email. You may also receive electronic notification. Look in your spam and junk folders — breach notifications often end up there.

Check your exposure. Use EmailLeaked to scan your email address against billions of records from known breaches. It takes less than 10 seconds and shows you exactly what information has been exposed across all known breaches — not just this one.

Even if you do not receive a notification letter from Kaplan, it is worth checking. Breach notifications sometimes miss people due to outdated contact information.

What should you do right now if you are affected?

If your data was part of the Kaplan breach — or if you think it might have been — take these five steps immediately:

1. Enroll in Kaplan’s free credit monitoring

Kaplan is offering complimentary identity protection services through Experian IdentityWorks to affected individuals. Your notification letter will include an enrollment code and instructions. Do this first — it is free, provided by Kaplan, and gives you alerts if someone tries to use your identity.

2. Place a fraud alert on your credit reports

Contact any one of the three major credit bureaus (Equifax, Experian, or TransUnion) and request a fraud alert. When you place a fraud alert with one bureau, it automatically notifies the other two. This makes it harder for someone to open new accounts in your name because creditors are required to take extra steps to verify your identity.

  • Equifax: 1-800-525-6285
  • Experian: 1-888-397-3742
  • TransUnion: 1-800-680-7289

3. Consider a credit freeze

A credit freeze is stronger than a fraud alert. It completely blocks new creditors from accessing your credit report, which means no one can open new accounts in your name — including you — until you lift the freeze. Freezing and unfreezing is free and can be done online with each bureau.

This is the single most effective step you can take against identity theft when your SSN has been exposed.

4. Monitor your financial accounts closely

For the next 12 months at minimum, check your bank statements, credit card statements, and any financial accounts for transactions you do not recognize. Set up transaction alerts through your bank’s mobile app so you get a notification for every charge.

Also check your credit report. You are entitled to free weekly credit reports from all three bureaus at AnnualCreditReport.com. Look for accounts you did not open, addresses you do not recognize, and inquiries you did not authorize.

5. Watch for phishing and scam attempts

After any major breach, scammers send fake emails pretending to be the breached company. They may send emails that look like they are from Kaplan or from Experian, asking you to “verify your identity” or “click here to activate your monitoring.” These are traps.

Never click links in emails about the breach. Instead, go directly to the company’s website by typing the URL into your browser. If Kaplan’s notification letter includes a web address for enrollment, type that address manually — do not click links.

How can you prevent damage from breaches like this?

You cannot prevent a company from being breached — that is their responsibility. But you can reduce the damage when it happens:

Use unique passwords for every account. If Kaplan had stored any login credentials and you used the same password elsewhere, every one of those accounts would also be at risk. A password manager generates and stores random passwords so you never reuse one.

Enable two-factor authentication everywhere. Even if an attacker gets your password, two-factor authentication stops them from logging in without access to your phone or authentication app.

Freeze your credit proactively. You do not need to wait for a breach. A credit freeze costs nothing and prevents most forms of new-account identity theft. You can temporarily lift it in minutes when you need to apply for credit.

Reduce your data footprint. The less personal information companies have about you, the less can be stolen. Delete old accounts you no longer use. Do not give out your SSN unless it is legally required. Ask companies what data they collect and how they protect it.

Check your email regularly. Use EmailLeaked to monitor whether your email appears in new breaches. The sooner you know, the faster you can act.

Frequently asked questions

How many people were affected by the Kaplan data breach?

Over 230,000 people across multiple states were affected. The largest group was in Texas with 173,676 people, followed by South Carolina with 26,612, Maine with 19,075, New Hampshire with 11,653, and Rhode Island with 2,045. Additional states may report numbers as filings continue.

What data was exposed in the Kaplan breach?

The exposed data includes names, Social Security numbers, and driver’s license numbers. This combination is considered critical severity because SSNs and driver’s license numbers are primary identity documents that can be used to commit fraud and steal identities.

When did the Kaplan breach happen?

Unauthorized access to Kaplan’s systems occurred between October 30, 2025 and November 18, 2025. Kaplan reported the breach to the South Carolina Department of Consumer Affairs on March 17, 2026, approximately five months after the intrusion began.

Is Kaplan offering credit monitoring?

Yes. Kaplan is offering complimentary identity protection services through Experian IdentityWorks to individuals whose information was exposed. Affected individuals should receive a notification letter with an enrollment code and instructions for activating the service.

Should I be worried if I used Kaplan years ago?

Yes, you should still check. Companies often retain personal data long after your direct relationship with them ends. Even if you used Kaplan’s services years ago, your SSN and driver’s license number may still have been in their files at the time of the breach. If you receive a notification letter, act on it immediately.

Can I sue Kaplan for this breach?

Class action lawsuits are common after large data breaches involving SSNs. It is too early to say whether one will be filed in this case, but affected individuals should watch for announcements. In the meantime, focus on the protective steps above — enrolling in the free monitoring, placing fraud alerts, and freezing your credit — as those provide immediate protection.