Case in Point

During our winter break I came across a concept that I read about a few years ago but hadn’t thought about lately. The Shopping Cart Theory began anonymously on an internet message board sometime in 2020. It posits that whether a person returns their shopping cart or doesn’t is the ultimate litmus test of their capacity for self-governance and determines whether they are a “good” or “bad” member of society. It is not illegal to leave a shopping cart somewhere else, nor will returning it be rewarded (Aldi’s quarter return excepting). Returning a shopping cart is the right thing to do for the good of society – maintaining a clear and orderly parking lot – but it is not enforced or monitored. Not returning their cart suggests that a person won’t do the right thing unless threatened with consequences.

This theory has been extrapolated to make commentary on society as a whole and the necessity of having people who will do the right thing because it’s the right thing regardless of external factors. It causes us to examine our own motivations. Do we do right because it is right or because we are required to?

There are holes that have been poked in this argument, with good reason. There are people who may not be able to return their carts – those with disabilities, emergencies, or who don’t want to leave children unattended, etc. But I believe there is good in a message that we should do the right thing simply because it’s the right thing. That message will always have a place. Certainly, our campus compliance and ethics programs will be better with that mentality.

As we begin our 18th year of publication, we will continue our tradition of looking back at what occurred during the prior year. Overall, here is how our categories broke down with respect to articles linked in 2025:

· Information Security & Technology: 14% (11% in 2024)

· Fraud & Ethics: 10% (11% in 2024)

· Compliance & Legal: 37% (40% in 2024)

· Campus Life & Safety: 39% (38% in 2024)

Next month we will begin looking for trends in these categories and make some predictions for 2026. Until then, we invite you to review the news stories from January with a view toward proactive risk management. As always, we welcome your feedback.

Jan 29: Ransomware: On Dec. 4, 2025, Trocaire College, a private Catholic institution in Buffalo, N.Y., discovered that a ransomware attack had compromised its digital environment. The incident, which was first detected as unusual activity on March 13, 2025, led to a forensic investigation with help from independent cybersecurity experts. The investigation determined that unauthorized actors accessed or acquired certain files between March 12 and March 13, 2025. (link)

Jan 14: Data Breach: Monroe University has disclosed a major data breach affecting more than 320,000 individuals, following a prolonged forensic investigation that concluded nearly a year after the intrusion took place. The breach was first uncovered on September 30, 2025, when Monroe determined that an unauthorized third party had accessed its internal systems and exfiltrated data during a two-week period between December 9 and December 23, 2024. (link)

Jan 12: ​Ransomware: University of Hawaii says a ransomware gang breached its Cancer Center in August 2025, stealing data of study participants, including documents from the 1990s containing Social Security numbers. (link)

Jan 12: Data Breach: On Dec. 18, 2025, Clackamas Community College discovered a data breach that has affected 33,381 individuals across the United States. The breach was the result of unauthorized access to a small number of the college’s systems, with files acquired by an unknown third party on Oct. 24, 2025. (link)

Jan 05: AI: The assignments looked brilliant. The understanding didn't. That's when an NYU business school professor decided to fight AI-assisted coursework with AI-powered oral exams. Panos Ipeirotis, a professor at NYU's Stern School of Business who teaches data science, wrote in a blog post published last week that he became concerned about student assignments that read like "a McKinsey memo" but lacked genuine understanding. (link)

Jan 05: Cyberattack: Aurora College staff are working to get systems back online after a cyber attack over the December break, according to an announcement issued Sunday. Jayne Murray, the college’s communications manager said that staff are working to "purge any malicious codes," from the system. (link)

Jan 01: Cyberattack: Baker University has disclosed a data breach after attackers gained access to its network one year ago and stole the personal, health, and financial information of over 53,000 individuals. (link)

Jan 01: Cyberattack: The Clop ransomware gang has stolen the data of nearly 3.5 million University of Phoenix (UoPX) students, staff, and suppliers after breaching the university's network in August. Headquartered in Phoenix, Arizona, UoPX is a private for-profit university founded in 1976 with 82,700 enrolled students and 3,400 employees (nearly 2,300 academic staff). (link)

Jan 28: Academic Integrity: Amid accusations of AI cheating, some students are turning to a new group of generative AI tools called "humanizers." The tools scan essays and suggest ways to alter text so they aren’t read as having been created by AI. Some are free, while others cost around $20 a month. (link)

Jan 19: Mismanagement: In a release Jan. 7, The Jefferson Council -- a group of conservative University alumni -- shared a 239-page document which included a report on U.Va. Health, detailing misconduct under the leadership of [the] former chief executive officer of U.Va. Health and [the] former dean of the School of Medicine. (link)

Jan 15: Gambling Conspiracy: Federal prosecutors charged 26 people on Thursday, including several former and current college basketball players, in an alleged point-shaving scheme, according to an indictment obtained by CBS News. The indictment states that more than 39 college basketball players on at least 17 Division I teams "fixed and attempted to fix" over 29 games. (link)

Jan 12: Fraud: A Cal-State system review of the Fresno State Foundation, the nonprofit that manages hundreds of millions in donor gifts and endowments, uncovered egregious weaknesses in its operations that increased its exposure to financial fraud, according to a 32-page report outlining the findings. (link)

Jan 08: Occupational Fraud: A man pleaded guilty to defrauding The Claremont Colleges out of over $1 million through a wire fraud scheme. [The man] has been an electrical shop supervisor for The Claremont Colleges Services (TCCS) since 2015. He was responsible for maintaining the electrical components for all seven campuses across Los Angeles County, including ordering parts and supplies when needed. From June 2018 to July 2024, [he] embezzled approximately $1,000,571 from his employer through at least 1,343 unauthorized transactions, prosecutors said. (link)

Jan 01: Conflict of Interest: Clemson University’s soon-to-retire president stands out as the only South Carolina public college president to sit on a corporate board. The chief executive of the Upstate college, until recently, sat on the board of two publicly traded companies: a homebuilding firm and a bank. But it’s not unusual for college presidents, of both public and private universities, to take positions on corporate boards. (link)

Jan 28: Title IX: The Trump administration has concluded that San Jose State University discriminated against women by letting a transgender athlete play on the women’s volleyball team, the U.S. Education Department said Wednesday. (link)

Jan 27: ADA: Pennsylvania Western University must allow a professor to teach all of her courses online in order to accommodate a disability, a judge ruled this month, affirming the decision of an arbitrator. (link)

Jan 23: Employee Conduct: An instructor at Vanderbilt University Medical Center was charged with 13 counts of sexual exploitation of a minor in Sumner County. [The man] was listed as an instructor of clinical anesthesiology at VUMC. (link)

Jan 21: Federal Compliance: President Trump had barely returned to power last year when Hector F. Ruiz, a veteran civil rights lawyer for the Justice Department, shared a directive with his team that some found chilling. He told the team that he had been instructed to open investigations into more than a dozen universities, according to two people with direct knowledge of the meeting. (link)

Jan 21: Settlement: The California Faculty Association (CFA), other union groups, and the CSU settled a lawsuit that was filed after Cal State LA gave private worker information to the Equal Employment Opportunity Commission (EEOC) last fall, before on-campus unions had a chance to respond or dispute the order by the EEOC. (link)

Jan 21: Settlements: A new report by the United Educators insurance company shows that universities spent hundreds of millions of dollars on damages in 2025, according to an analysis of publicly reported settlements. Legal cases involved a variety of issues, ranging from deaths on campus to antitrust issues, cybersecurity breaches, discrimination, sexual misconduct and pandemic-era policy fallout. (link)

Jan 14: Title IX: The U.S. Department of Education announced a string of Title IX investigations Wednesday into state and local school systems with policies that allow transgender students to play on sports teams aligning with their gender identity. The 18 investigations come just a day after the U.S. Supreme Court heard arguments in a case that could decide the future of transgender student athlete participation on sports teams. (link)

Jan 09: Title IX: Families of four University of Idaho students want to hold Washington State University accountable for not acting on warnings about graduate student Bryan Kohberger. "The lawsuit seeks damages from Washington State University for violations of Title IX, the federal law that prohibits sexual harassment and stalking in public universities, and for its negligence and failure to protect the community at large." (link)

Jan 08: Settlement: The American Civil Liberties Union (ACLU) of South Carolina announced that an assistant professor at Clemson University's Department of Environmental Engineering and Earth Sciences has won a settlement after he was fired over a social media post. (link)

Jan 05: Clery Compliance: The U.S. Department of Education announced last month that it would review Brown University’s security procedures to determine if it violated the Clery Act after two students were fatally shot on Dec. 13. The Clery Act requires colleges and universities to produce annual security reports (ASR) detailing crime statistics on campus, as well as their safety and security procedures. (link)

Jan 01: Risks: Each year, United Educators’ (UE’s) college and university members share their most pressing risks in the Top Risk Survey. This year’s survey reveals the self-reported top risks across UE’s higher education membership and highlights changes from 2020-25. (link)

Jan 26: Sexual Assault: Miami Gardens police say they’re investigating a sexual assault on the Florida Memorial University campus. According to police, it happened just after 7 a.m. Sunday. Police said the victim, a student, “was waiting at a bus stop when she noticed an unknown male whistling at her." (link)

Jan 23: Threats: At least four campuses on Thursday received swatting calls--false reports of active or impending threats intended to disrupt operations and whip up a significant police response. (link)

Jan 21: Sexual Assault: Another man has been convicted in the sexual assault of a woman at a central Minnesota college. A jury found [a] 21-year-old guilty of two counts of first-degree criminal sexual conduct and one third-degree count of the same, court records show. His codefendant, [a] 20-year-old, pleaded guilty to one count of aiding and abetting first-degree criminal sexual conduct in October. (link)

Jan 20: Social Media Threat: Two Penn State University Park students are facing criminal charges after police say a false threat was posted on social media in an effort to disrupt a final exam last December. (link)

Jan 20: Campus Security: At age 19, Alexander Fenton can legally vote, fight in a war and carry a gun. When he steps onto the campus of the University of New Hampshire, where he studies business, the latter goes out the window. The college prohibits the possession and use of firearms. Fenton doesn’t think that’s fair -- and a proposed law could change it. (link)

Jan 18: Hazing: Former Phi Kappa Sigma pledge James Haussman is suing the administrators of the Tulane Educational Fund, or Tulane University, the Phi Kappa Sigma-Mu Chapter, Phi Kappa Sigma International Fraternity and 14 fraternity members over alleged hazing that occurred in the 2025 spring semester. (link)

Jan 16: Sexual Assault: Before President Donald Trump’s administration started dismantling the Education Department, the agency served as a powerful enforcer in cases of sexual violence at schools and universities. It brought the weight of the government against schools that mishandled sexual assault complaints involving students. That work is quickly fading away. (link)

Jan 15: Shooting: Two Flint men face charges related to a shooting on Jan. 10 at Mott Community College's Ballenger Fieldhouse. Genesee County Prosecutor David Leyton charged two 23-year-old men, including the alleged shooting victim, with several felonies for the incident in a bathroom during a basketball game. The shooting was ruled self defense. (link)

Jan 13: Sexual Assault: Police at the University of California, Los Angeles, are investigating a sexual assault that allegedly occurred on campus. The UCLA Police Department stated in a campus community alert that around 12 a.m. on Monday, officers received a report of a sexual assault in the 600 block of Landfair Avenue. The address provided is part of the university’s Fraternity Row -- where many fraternity houses are located. (link)

Jan 02: Free Speech: When [a professor] suggested on X, three days after the October 7 Hamas attack in Israel, that "zionist journalists" and their kids should fear for their lives, the University of California at Davis was besieged with hundreds of letters, including demands that she be fired, complaints from students and staff who said they felt scared and angry, and threats from donors to withhold future gifts. (link)

Jan 01: Hazing: Montclair State University Police Department (UPD) are investigating a reported hazing incident after an anonymous call. According to a Dec. 9 police blotter, the Montclair State University Police Department received an anonymous call on Wednesday, Nov. 26, reporting a hazing incident. UPD is conducting a law enforcement investigation following these allegations. (link)