The breach impacted current and former students and employees at Maricopa County Community College, who were not notified of the incident for seven months, The Arizona Republic in Phoenix reported Wednesday.
The district's governing board agreed Tuesday to spend up to $7 million to notify anyone potentially affected, said spokesman Tom Gariepy.
The letters will go to people who have been students, employers or vendors at the districts' 10 colleges over the past several years.
The district learned of the breach April 29 when the FBI reported it found a website advertising personal data from the college system.
Gariepy said the district couldn't announce the breach earlier because it was investigation the extent of exposure.
The board has approved several million dollars to repair the college's computer system to prevent another breach.
Data possibly exposed included employee's Social Security numbers, driver's license numbers and bank accounts, Gariepy said. Students' personal information was not believed to have been breached.
There was no evidence any information was actually looked at or stolen, Gariepy added.