Attackers claim to have stolen data on over a million individuals associated with the university.

(emphasis added)

Many universities have a conferencing department that rents out residential and nonresidential rooms on campus when not in use by students. Some universities can have tens of thousands of people on campus in a single summer. In addition to students, staff, vendors, etc., all of whom the university might have stored info about, that might make it take fewer than 100 years to get up to 1,000,000. If that number is accurate.

If you're still a dependent while a student, completing the FAFSA requires submitting tax information from both your parents. Information on applicants who didn't actually attend would also be in their systems.