Penn is investigating a cybersecurity breach of its Oracle E-Business Suite servers that compromised the personal information of University-affiliated individuals across multiple states. The breach — identified by the University in November — exploited the business software Penn uses to manage internal operations, according to letters filed with attorneys general in multiple states. Penn is in the process of notifying individuals whose personal information was compromised by the incident, according to a University spokesperson. “The University of Pennsylvania was one of nearly 100-already identified organizations simultaneously impacted by the widely exploited Oracle E-Business Suite incident, involving a previously unknown security vulnerability in Oracle’s system,” the spokesperson wrote in a statement to The Daily Pennsylvanian. Penn has implemented “the patches that Oracle issued to resolve the vulnerability” and “has found no evidence that any of this information has been or is likely to be publicly disclosed or misused for fraudulent purposes,” the statement added. In a Dec. 1 letter notifying impacted individuals, Penn wrote that its investigation — assisted by federal law enforcement and cybersecurity experts — discovered that “some data from Penn’s Oracle EBS had been obtained without authorization.” It remains unclear how many individuals were affected. According to information filed with the Office of the Maine Attorney General, the breach affected 1,488 state

The University of Pennsylvania has revealed a data breach stemming from a cyberattack on its Oracle financial systems. Quick Summary – TLDR: Hackers exploited a zero-day flaw in Oracle E-Business Suite to access Penn’s internal systems. Personal data of at least 1,488 individuals was stolen, with the real number possibly much higher. The Clop ransomware gang is suspected, linking Penn to a wider cyber extortion campaign. Penn joins other Ivy League schools recently hit by phishing and data theft attacks. What Happened? The University of Pennsylvania has confirmed a data breach involving its Oracle E-Business Suite (EBS) after attackers exploited a previously unknown vulnerability to steal sensitive personal information. The incident occurred in August but was officially disclosed in a filing with the Maine Attorney General’s office. The university says the breach is part of a larger cyberattack campaign affecting nearly 100 organizations. Penn’s Oracle Systems Breached In the breach notification sent to affected individuals, the university explained that unauthorized access to Penn’s Oracle EBS platform had occurred. A thorough investigation revealed that personal data was stolen, although the specific types of information remain undisclosed. The university has directly notified the 1,488 confirmed impacted individuals, though it admits the actual number could be far greater. In an official statement, Penn said: “ We discovered that some data from Penn’s Oracle EBS