Your SAT or ACT data could be compromised if you receive a breach notification from a test organization, educational institution, or related service; discover unfamiliar accounts opened in your name; or learn that your personal information has appeared in public data breaches or on the dark web. Major incidents have exposed millions of test-takers’ records in recent years, making these warning signs increasingly common for students and their families. The risk is more acute than many realize. In March 2025, hackers breached NYU’s website and exposed over 3 million applicants’ personal data, including SAT scores, ACT scores, GPAs, names, majors, zip codes, and financial aid information dating back to 1978. The intruder maintained access for more than two hours before the page was taken down, meaning sensitive test data was publicly accessible online.
This incident demonstrates how widely distributed your exam records may be—not just with the College Board, but across multiple institutions that have collected and stored that information. Understanding what compromise looks like is the first step in protecting yourself. The signs often appear gradually: a suspicious credit inquiry here, a debt collection call there. But they can also come suddenly, as when you receive formal notification that a database containing your test scores has been breached. Knowing which warning signs matter most will help you respond quickly if your data is at risk.
Table of Contents
- How to Recognize a Direct Breach Notification
- Identity Theft and Unauthorized Accounts
- Suspicious Activity in Your Own Accounts and Email
- Using Identity Monitoring Services to Detect Compromise
- Financial Red Flags and Debt Collection Warnings
- Unauthorized Data Sales and Third-Party Exposure
- Looking Forward—Data Breaches and Your Rights
- Conclusion
How to Recognize a Direct Breach Notification
Breach notifications are the clearest warning sign that your SAT or ACT data has been compromised. When a database containing your test scores is hacked or improperly accessed, organizations are legally required to notify you within a specific timeframe (the timeline varies by state and the nature of the breach). These notifications may come via email, postal mail, or through a press release if the breach affects a large number of people. However, not all notifications are created equal. Some will be vague—”Your information may have been exposed”—while others are specific about what was taken and when.
In the College Board privacy settlement with New York State in February 2024, it was revealed that the company had been unlawfully sharing and selling student data, including SAT and PSAT scores, to third parties for commercial and marketing purposes without proper student consent. That violation led to a $750,000 penalty and new restrictions on how the organization can use student exam data. The settlement shows that even major test administrators have mishandled your information, so take all notifications seriously, especially those mentioning exam scores or educational records. One limitation of relying solely on breach notifications: not every organization discovers breaches immediately, and some never disclose them publicly. The NYU hack exemplifies this gap—the hacker had access for over two hours before anyone noticed, meaning affected students had no way of knowing their information was compromised during that window. This is why breach notifications alone are not enough; you need to monitor your own accounts and credit for signs of misuse.
Identity Theft and Unauthorized Accounts
When your SAT or ACT data is compromised, identity thieves gain access to personal information that can be used to open new accounts, apply for loans, or commit fraud in your name. The warning signs of this kind of abuse include unfamiliar credit inquiries appearing on your credit report, unexpected debt collection calls for accounts you never opened, and loan denials when you know your credit history is clean. The College Board settlement revealed another mechanism for misuse: unauthorized sharing of student data with third parties. When your test scores, GPA, name, zip code, and other identifiers fall into the hands of marketers or data brokers, you become a target for predatory lending, unwanted financial solicitations, and other scams that exploit your student status. Identity thieves particularly prize test scores and educational information because, combined with your name and address, they form a powerful identity package that can convince banks and lenders to extend credit in your name.
The younger the breach victim, the more dangerous this is—a high school student’s compromised data could be used to open accounts that go undetected for years. A critical limitation here is that identity theft often takes time to surface. You might not notice a fraudulent account opened in your name for months or even years, especially if it’s a credit card or line of credit you don’t monitor regularly. Conversely, some types of identity fraud are caught quickly—for instance, if someone tries to file a tax return using your Social Security number, the IRS may reject the filing and notify you. The unpredictability means you need active monitoring, not just reactive detection after damage occurs.
Suspicious Activity in Your Own Accounts and Email
One of the most telling signs that your SAT or ACT data has been compromised is discovering suspicious activity in accounts you use to manage your test registrations or educational records. This might include emails in your sent folder that you didn’t write, unexpected password reset notifications, or login attempts from unfamiliar devices or locations. Hackers who gain access to SAT and ACT records often go further and attempt to gain access to students’ personal email accounts or online educational portals. They may use your exam data (which often includes your email address) to attempt password resets or account recovery on your email, social media, or financial accounts. In the case of the NYU breach, the exposed data included names, email addresses, and zip codes—exactly the information needed for social engineering attacks to compromise other accounts.
If you notice logins from cities where you don’t live, or multiple failed login attempts followed by a successful one, that’s a strong signal that someone has your credentials. The challenge with detecting account compromise is that some signs are subtle or easily overlooked. A single suspicious email in your sent folder might get lost among hundreds of legitimate messages. A login from an unfamiliar location might be explained away as a friend using your device. But when these small signs accumulate—multiple suspicious emails, failed login attempts, and changes to account settings you didn’t make—the picture becomes clear: someone else has access to your account.
Using Identity Monitoring Services to Detect Compromise
Identity monitoring services are one of your most valuable tools for detecting whether your SAT or ACT data has been compromised. These services scan the dark web, public data breach databases, and data broker sites for your personal information. If your name, Social Security number, test scores, or other identifying information appears in a newly discovered breach, the service alerts you immediately, often before you would find out any other way. Companies like Have I Been Pwned and Data Breach Lookup maintain searchable databases of information from known breaches. You can manually check whether your email address appears in these databases, though doing so repeatedly is tedious. Paid identity monitoring services automate this process and go further—they scan not just the databases you can access, but also dark web marketplaces where stolen data is bought and sold.
The downside is that most of these services cost money (typically $10–$20 per month) and they can’t prevent identity theft; they can only alert you after your information has already been compromised. Think of identity monitoring as an early warning system, not a shield. Some services also include credit monitoring and fraud detection for financial accounts, which adds value but increases cost. The tradeoff to consider: free manual checks through Have I Been Pwned are better than nothing, but they only show you breaches that service has discovered and cataloged. Paid monitoring services offer more comprehensive scanning and dark web monitoring, but they require an ongoing subscription and you’re trusting a third party with access to your personal information in order to monitor it. Choose based on your risk tolerance and budget. If your data was exposed in the NYU breach or similar large-scale incident, registering with an identity monitoring service immediately after notification is a smart move.
Financial Red Flags and Debt Collection Warnings
One of the most jarring warning signs that your SAT or ACT data has been misused is receiving unexpected calls or letters from debt collection agencies about accounts or loans you never opened. This happens when identity thieves use your name, date of birth, and identifying information to apply for credit or take out loans. The debt collectors are pursuing what they believe to be legitimate debts, but you know you never authorized the account. Debt collection contacts for accounts you don’t recognize are almost always a sign of identity theft. When combined with other warning signs—like unknown credit inquiries on your credit report or fraudulent credit card charges—they paint a picture of systematic identity theft.
The danger is compounded if the thief’s fraudulent accounts go unpaid, damaging your credit score and making it harder for you to obtain legitimate credit. In worst-case scenarios, debt collectors pursue you aggressively, harassing you repeatedly even after you provide proof that the debt is fraudulent. One important limitation: not all identity theft results in debt collection contacts. Thieves might open accounts, use them minimally, and keep them in good standing specifically to avoid detection. Or they might target fraud that doesn’t generate debt—like using your identity to open a cell phone account, redirect mail, or commit other forms of fraud that don’t result in unpaid debts. This means the absence of debt collection notices doesn’t mean your identity is safe; it simply means the thief hasn’t used your information for unsecured credit in a way that defaulted.
Unauthorized Data Sales and Third-Party Exposure
Beyond direct hacking, another way your SAT or ACT data can be compromised is through unauthorized sales and data broker activity. The College Board settlement in February 2024 exposed a troubling practice: the company had been sharing and selling student data—including SAT and PSAT scores—to third-party marketers and data brokers without proper student consent. The New York Attorney General’s settlement prohibits this practice going forward and requires College Board to compensate those affected, but it revealed how even major, official organizations can misuse your test data for profit.
If you’ve noticed an increase in targeted marketing emails about college prep services, financial aid offers, or student loan products after taking the SAT or ACT, that’s a sign your data may have been sold to third parties. You might receive calls from colleges you didn’t apply to, emails from test prep companies, or offers for student loans tailored to your academic profile. While this is less immediately dangerous than identity theft, it represents a violation of your privacy and can lead to phishing attempts or scams designed to exploit students’ college-related financial needs.
Looking Forward—Data Breaches and Your Rights
The frequency and scale of SAT and ACT data breaches show no sign of slowing down. As more educational and testing organizations move records online and share data across multiple platforms and third parties, the surface area for breaches expands. The NYU incident, which exposed records dating back to 1978, demonstrates that breached data can accumulate over decades before being discovered. Future breaches will likely continue to expose large numbers of records, and students taking the SAT or ACT should assume their data is at some risk.
However, your rights are also evolving. State privacy laws are becoming stronger, and settlements like the College Board’s $750,000 penalty signal that organizations can be held accountable for data misuse. Know your state’s data breach notification laws and check whether you may be eligible for compensation or enrollment in credit monitoring services if your data was exposed in a major breach. Staying informed about your data’s security is no longer optional—it’s a necessary part of protecting yourself in an increasingly digital education system.
Conclusion
Recognizing the signs that your SAT or ACT data has been compromised is critical to protecting yourself from identity theft and fraud. The clearest warning signs include breach notifications directly from institutions or test organizations, unfamiliar credit inquiries and debt collection attempts, suspicious activity in your email or online accounts, and alerts from identity monitoring services. Major incidents like the NYU breach of over 3 million applicants’ records and the College Board’s unlawful sale of student data show that your test information is widely circulated and at genuine risk of exposure.
Take action immediately if you notice any of these warning signs. Check your credit reports for unfamiliar accounts, register with free breach notification services, and consider paid identity monitoring if you were affected by a major breach. Monitor accounts associated with your SAT or ACT registration, report any fraudulent accounts to the FTC, and dispute any debt collection attempts for accounts you didn’t authorize. Your vigilance in the weeks and months following a breach notification could be the difference between early detection of fraud and years of damage to your credit and financial security.