BleepingComputer reports that popular cap and gown manufacturer Herff Jones launched an investigation into a data breach after graduating students from various universities across the U.S. complained of seeing fraudulent charges to their payment cards, which they used to buy commencement gear.

Affected students at universities in Boston, Delaware, North Carolina, Florida and New York, had to dispute the fraudulent charges with their respective banks and some had to cancel their cards. The illegal charges ranged from $80 to $4,000. According to reports, one student’s card information was used to purchase a PS5, while another student’s credit card was used to buy at Asics and subscribe to adult content subscription service OnlyFans.

“We sincerely apologize to those impacted by this incident. We are working diligently to identify and notify impacted customers,” according to a statement released by the company. Herff Jones is employing “a leading cybersecurity firm” to help with the investigation.