Five Boston University graduates have filed three separate class-action lawsuits in Boston federal court, accusing their alma mater of failing to protect their personal data from an alleged theft that, so far, rests entirely on a single post on X. The lawsuits, filed Wednesday and Thursday, seek lead-plaintiff status on behalf of a broader class of former students and staff who say their sensitive information was put at risk.
According to Universal Hub, the first suit was filed Wednesday, November 11, by Charles Amar, Nikolay Kolev and Sarah Potwin, all BU graduates from New York. A second suit followed Thursday, filed separately by Richard Khazanov, a BU alumnus from Boston, and by Arthur Capone, a BU alumnus from New York. All three cases were brought in Boston federal court, and the alumni are represented by attorneys based in New York, Miami and Chicago.
The entire basis for the litigation traces back to a single X.com post from November 1 that announced an alleged theft of detailed personal data belonging to tens of thousands of past and present BU students and staff. The post reportedly claimed the breach involved an 8-gigabyte file that could contain roughly 2.2 million rows of data, allegedly including Social Security numbers, contact information, grades, and passport and visa records for foreign students. Notably, the post itself cautioned that the claim had not been independently verified and that caution was warranted — a caveat the lawsuits now have to grapple with as they move through the courts.
Neither BU Nor State Regulators Have Confirmed a Breach
As of the filings, neither Boston University nor the Massachusetts Department of Consumer Affairs and Business Regulation has reported the alleged incident, per the same Universal Hub account. That leaves the lawsuits built almost entirely on an unverified social-media claim rather than any confirmed disclosure from the university or state regulators.
Massachusetts law requires that notice of a security breach be provided “as soon as practicable and without unreasonable delay” once a person or agency knows or has reason to know a breach occurred, according to guidance from Mass.gov. Whether that standard applies here depends on confirmation that has not yet materialized from either BU or the state.
What the Complaints Allege
The first lawsuit, per the complaint, alleges BU failed to invest adequate resources to protect plaintiffs' and class members' private information and failed to implement practices and systems to mitigate deficient IT risks. It seeks restitution, actual and nominal damages, injunctive relief, disgorgement of profits, and other relief.
Richard Khazanov's suit alleges BU inadequately limited, monitored and investigated access to sensitive records, and that unauthorized access resulted in information supplied for education and account administration being obtained. Khazanov said he entrusted BU with his Social Security number, identifying information, student records and payment records while attending the university, and the complaint argues BU — not the plaintiffs — controls the logs, retention records and forensic findings that would show what actually happened. His filing further alleges that the university retained his records after graduation, and that the loss of control over a dataset of this size put sensitive identifiers and nonpublic academic and payment information into unauthorized hands.
Arthur Capone's lawsuit alleges BU failed to implement reasonable safeguards in identity and access management, monitoring, risk assessment and incident response, and it cites the NIST Cybersecurity Framework alongside BU's own data protection standards as the benchmark the university allegedly fell short of. Collectively, the alumni are seeking an order requiring BU to improve its data protections, along with damages, attorney fees and court costs.
A Pattern Familiar to BU and Other Universities
This would not be BU's first brush with a data-security scare. In 2020, BU and Emerson College notified students, alumni and others about a potential breach after one of their technology vendors, Blackbaud, suffered a ransomware attack, according to the Boston Globe. More recently, BU confirmed that hackers accessed a server tied to the long-running Framingham Heart Study and copied files containing participants' personal and medical information, according to the university's own account. BU said information relating to all 15,448 study participants was affected, though fewer than 2 percent of living participants had their Social Security numbers impacted.
Litigation after alleged university data exposures is far from unique to BU. A former Vanderbilt University student and employee filed a federal class-action suit in Nashville following a cyberattack there, according to NewsChannel 5. And a proposed class action against Educational Testing Service alleged the company failed to implement reasonable protections for student information, in a case reportedly affecting roughly 7 million current and former California public school students, as reported by GovTech.
The broader numbers suggest why higher education has become a frequent target. Ransomware gangs globally claimed 251 attacks on educational institutions in 2025, just a few more than 2024's 247, but the records exposed by confirmed attacks jumped to 3.9 million, a 27 percent increase over the prior year, per a separate GovTech analysis. In the U.S. specifically, higher-education institutions accounted for 3.7 million of those breached records in 2025, compared with 175,000 for K-12 schools.
For now, the BU case remains an open question built on an unconfirmed claim. Whether the university or state regulators will weigh in — and whether the alleged data was ever actually accessed, copied or misused — has not been established, leaving the five alumni and their attorneys to press their case in court while BU stays silent.
