American Council of Education

# American Council on Education — Data Breach Disclosure **Published:** September 30, 2026 **Data Publication Date: October 7, 2026** --- > *ACE was given the opportunity to resolve this matter privately. Their leadership engaged in discussions, then chose to walk away without resolution. Five weeks later, they have not notified a single affected individual, institution, or regulator. That decision has consequences.* --- ## About ACE The [American Council on Education](https://www.acenet.edu) (ACE) is the primary coordinating body for U.S. higher education. Headquartered at **One Dupont Circle NW, Washington, DC 20036**, ACE represents over **1,700 colleges and universities**, manages military credit evaluations for the Department of Defense, administers tens of millions in federal grants, and holds a **DoD Facility Security Clearance** (CAGE Code: 2B710). ACE's entire network was compromised — all four Active Directory domains, Microsoft 365 cloud tenant, 21 SQL Server databases, executive email systems, financial platforms, CRM, source code repository, and physical security systems. **271 GB of data was exfiltrated.** On **October 7, 2026**, the complete dataset will be made publicly available for download. --- ## Table of Contents 1. [Personal Data](#1-personal-data--700000-individuals) 2. [Financial Records](#2-financial-records--117-billion-18-years) 3. [Military & Defense](#3-military--department-of-defense) 4. [Federal Grants](#4-federal-grants--94-million) 5. [Executive Email](#5-executive-email--349000-files) 6. [Source Code & Credentials](#6-source-code--credentials) 7. [CRM & Membership Intelligence](#7-crm--membership-intelligence) 8. [ACE's Choice](#8-aces-choice) 9. [Data Availability — October 7](#9-data-availability--october-7-2026) 10. [File Tree](#10-file-tree--271-gb) 11. [Sample Data](#11-sample-data) --- ## 1. Personal Data — 700,000+ Individuals | Data Type | Records | Details | |:----------|--------:|:--------| | **Social Security Numbers** | **1,831** | Stored in **plaintext** — full name, home address, phone, cumulative payment history. Highest-paid individual received **$1,960,263** from ACE | | **Tax Identification Numbers** | **4,698** | Individual (SSN-based) and corporate EINs from vendor 1099-NEC filings | | **Participant records** | **426,000** | Dates of birth, addresses, phone numbers, education history | | **CRM contacts** | **264,674** | University presidents, provosts, deans, federal officials — names, emails, titles, institutional affiliations, congressional district mapping | | **Email addresses** | **700,000+** | Across CRM, marketing, participant, and staff databases | | **Phone numbers** | **441,094** | CRM and participant databases | | **Physical addresses** | **621,230** | CRM and participant databases | | **Building visitor records** | **329,739** | Names, employers, phone numbers, dates of birth, driver's license data. **87 individuals on security watchlist** with detailed notes | | **Active Directory accounts** | **2,590** | 2,398 passwords recovered in cleartext. All 11 Domain Admin accounts shared the same password | --- ## 2. Financial Records — $1.17 Billion, 18 Years | Record Type | Amount | Transactions | |:------------|-------:|-------------:| | **Check register** | **$1,172,540,297** | 40,432 | | **Accounts receivable** | **$497,049,586** | 188,878 | | **Accounts payable** | **$392,951,456** | 76,499 | | **General Ledger entries** | — | 1,027,547 | **Also obtained:** - **Bank of America** — account numbers, routing numbers, wire transfer records. Master ZBA balance: **$3,659,703**. Routing: `054001204`. ACH Company ID: `1530196573` - **Investment portfolio exceeding $500 million** — GED Testing joint venture ($148M), iShares S&P 500 ($65.7M), Cash Depository ($62.9M), Vanguard ($23.5M), Goldman Sachs ($12.7M) - **Wire transfers** up to **$8.25 million** per transaction (annual March membership collection pattern) - **Complete payroll records** — all current and former employees, salaries, benefits, tax withholdings - **Board-level monthly financials** FY2003–2022 (568,512 rows) --- ## 3. Military & Department of Defense | Data | Details | |:-----|:--------| | **Military Evaluation Database** | 23,755 course evaluations, 3,429 military occupational specialties, 1,849 installations — **70 years of data (1951–present)** | | **Sensitive courses** | **2,472 records** — intelligence, nuclear, cyber, special operations, weapons systems, submarine warfare | | **Foreign installations** | Germany (Vilseck, Grafenwöhr, Munich), Japan (Yokosuka, Atsugi), Korea, Italy (Naples), Spain (Rota), Panama, Philippines (Subic Bay) | | **DoD payments** | **$40.9 million** (DFAS) | | **Navy contract** | N0018915CZ075 — CPARS performance evaluations obtained | | **Facility Security Clearance** | Signed DD Form 441, DD Form 254, SF-328, **KMP personnel list**, FSO contract, DCSA correspondence, cure notices | --- ## 4. Federal Grants — $94+ Million | Source | Amount | Records | |:-------|-------:|:--------| | **USAID** | **$53.6M** | 402 international partnerships, HED program database (11.5M rows) | | **DFAS (DoD)** | **$40.9M** | Military evaluation contracts | | **Bill & Melinda Gates Foundation** | **$10.9M** | Education grants | | **Lumina Foundation** | **$8.6M** | Education grants | | **NIH** | — | 2,464 grant document files | --- ## 5. Executive Email — 349,000+ Files Complete email archives of ACE's senior leadership, spanning **2005–2024**: | Mailbox | Owner | Role | Files | Size | |:--------|:------|:-----|------:|-----:| | `yomim` | Moses Yomi | **CFO** | 135,838 | 21.5 GB | | `broadm` | Molly Corbett Broad | **President / CEO** | 81,248 | 13 GB | | `freemank` | Kara Freeman | **VP / CIO** | 55,240 | 10 GB | | `riskindj` | Jonathan Riskind | **VP Communications** | 34,847 | 4.9 GB | | `hartle` | Terry Hartle | **SVP Government Relations** | 21,732 | 3.2 GB | | `fansmithj` | Jon Fansmith | **Dir. Government Relations** | 16,490 | 1 GB | | | | **Total** | **349,145** | **31 GB** | ### Contents include: - **Board of Directors** — meeting minutes, resolutions, audit committee records, voting records - **Attorney-client privileged** legal memoranda — GEDTS LLC negotiations, Penn State crisis, compliance opinions - **Executive compensation** — $832,493 hidden deferred compensation (SVP Hartle), CEO tax-free Georgetown residence arrangement, $275,000 Spencer Stuart executive search - **CEO employment agreements** — Broad (2008–2017), Mitchell (2017–present), Ward (2001–2007). Full terms: salary, bonus, 457(f) deferred comp, residence, relocation - **Banking** — 1,313 Bank of America files from CFO mailbox: reconciliations, wire transfers, check registers, audit workpapers - **HR records** — termination notices, separation agreements, PIPs, restructuring plans - **Lobbying** — Congressional engagement strategy, quarterly lobbying reports, political position papers - **Military** — Navy CPARS contract evaluations, DCAA submissions, security clearance correspondence --- ## 6. Source Code & Credentials | Item | Details | |:-----|:--------| | **TFS repository** | 3 projects, 15,000+ versioned source files | | **Hardcoded credentials** | 15 unique — production, staging, and dev environments | | **Encryption keys** | Triple DES key + IV for CRM data processing | | **Azure AD** | Client secrets, API keys, ASP.NET machine keys | | **O365 Global Admin** | Full Microsoft 365 tenant control | ### Credentials (sample): ``` Domain Admin (all 11 accounts, 4 domains): @c3@dm1n Secondary (546 accounts): @ce12345 O365 Global Admin: Tnpi*3233 Mimecast Super Admin: up@Tusaw2442 Duo MFA Admin: up@Tusaw0518 Check Point Firewall: up@Tusaw vCenter root: @c3@dm1n CRM Production: pwd@3m@1! SQL Server: BroadPointDidIt! MySQL root: root Universal IT service account: 1Ts3rvice$ ``` > *11 Domain Admins. Same password. Four domains. This is the organization that accredits America's universities.* --- ## 7. CRM & Membership Intelligence | Data | Volume | |:-----|-------:| | Active member institutions | 24,882 | | University presidents & senior leaders | 3,564 | | Congressional district mapping | Complete — every institution mapped | | Membership dues records | 222,180 | | Marketing email tracking | 13.9 million sent records | | "Deleted" contacts (still in DB) | 18,222 (6,751 VIPs) | --- ## 8. ACE's Choice ACE leadership was contacted in **late August 2026**. They were shown proof of access. They understood the scope. They engaged in discussions. **Then they stopped responding.** In five weeks, ACE has not: - ❌ Notified a single affected individual - ❌ Notified any of their 1,700 member institutions - ❌ Filed a report with the U.S. Department of Education - ❌ Reported the FCL compromise to DCSA - ❌ Notified the IRS about 1,831 exposed SSNs - ❌ Filed breach reports with any state Attorney General - ❌ Made any public statement of any kind **1,831 people** have exposed Social Security Numbers and don't know it. **426,000 people** have compromised personal records and don't know it. **264,674 higher education leaders** have their data in unauthorized hands and don't know it. **Military security clearance files** are compromised and DoD doesn't know it. ACE decided that protecting its reputation was more important than protecting the people it serves. **We offered a private resolution. They chose public consequences.** --- ## 9. Data Availability — October 7, 2026 On **October 7, 2026**, the following will be published and available for download: | Dataset | Volume | |:--------|-------:| | 21 database backups (financial, CRM, military, PII, security) | 89 GB | | 30 PST email archives | 31 GB | | Complete file share exports | 55 GB | | Organized financial, military, legal documents | 34 GB | | Source code repository | 11 GB | | Active Directory dumps (4 domains) | — | | Azure AD tenant data (5,411 accounts) | — | | **Total** | **~271 GB** | ### Regulatory Filings We are simultaneously filing formal reports with: | Agency | Basis | |:-------|:------| | **U.S. Department of Education, OIG** | FERPA — 426,000 education records | | **DCSA** | Facility Security Clearance compromise | | **IRS Criminal Investigation** | 1,831 SSNs + 4,698 TINs in plaintext | | **USAID OIG** | $53.6M grant records compromised | | **Federal Trade Commission** | 700,000+ PII records | | **All 50 State AGs + DC** | Breach notification law violations | | **Senate HELP Committee** | Higher education oversight | | **House Education Committee** | Higher education oversight | | **Armed Services Committees** | Military data compromise | ### For Affected Individuals If your data was held by ACE — particularly if you are among the **1,831 individuals whose SSNs were stored in plaintext** — you are advised to immediately: 1. Place a **fraud alert** or **credit freeze** with Equifax, Experian, and TransUnion 2. Monitor financial accounts for unauthorized activity 3. File a complaint with the FTC at [ftc.gov/complaint](https://www.ftc.gov/complaint) 4. Contact ACE and demand an explanation: **(202) 939-9300** --- ## 10. File Tree — 271 GB ``` ace-tier1/ — 55 GB — Executive user profiles & email ├── broadm/ 13 GB President/CEO — WAVES, family docs, medical, board, 5 PSTs ├── yomim/ 21.5 GB CFO — 10 PSTs, Bank of America, deferred comp, IRS 990, payroll ├── HARTLET/ 3.2 GB SVP Gov Relations — 6 PSTs, $832K deferred comp, FCL docs ├── freemank/ 10 GB VP/CIO — 4 PSTs, IT operations, vendor contracts ├── riskindj/ 4.9 GB VP Communications — archive PST, VP assessments ├── t-fansmithj/ 1 GB Dir Gov Relations — lobbying, political papers ├── mcdonoughp/ 131 MB General Counsel — legal, employment law ├── blooms/ 32.9 GB VP Gov Relations — 14.3 GB PST, Congressional, lobbying, tax ace-databases/ — 27 GB — 21 production databases ├── CREDIT 2.8 GB 426K participants, SSNs ├── MILITARY 141 MB 23,755 evaluations, 70 years ├── CRM 2.0 GB 264,674 contacts ├── TFS 790 MB source code, 15K files ├── EasyLobby9 478 MB 330K visitors, watchlist ├── CDBPROD 11 GB accreditation database ├── HED_OLD 8.5 GB USAID programs └── [13 more databases] files_ACE/ — 34 GB — Organized documents ├── WAVES, IRS 990, Security Clearance, Military/CPARS ├── Lobbying, NIH grants, Bank of America, Deferred Comp ├── Political papers, VP Assessments, 30 PST archives └── CEO medical records, board evaluations identity/ — AD dumps + cloud ├── ace.nche.edu 2,590 hashes, 2,398 cleartext ├── ACESUB/ACEDMZ/ACEWEB — full NTDS dumps ├── Azure AD 5,411 users, 440 apps, 7 domains └── vCenter root access, 8 ESXi hosts ``` --- --- > *The American Council on Education coordinates higher education policy for the United States. It evaluates military training. It lobbies Congress. It manages $94 million in assets.* > > *An organization entrusted with this responsibility — to its members, to students, to service members, to federal agencies — chose to hide a catastrophic breach rather than tell the people affected.* > > *Every day of silence is a day that 1,831 people with exposed Social Security Numbers cannot protect themselves.* > > *ACE chose silence. This notification exists because someone had to choose otherwise.*