The University of Pennsylvania suffered a targeted email hack where attackers exploited a PennKey single sign-on (SSO) account belonging to a university employee via social engineering. The breach granted unauthorized access to multiple systems, including the Customer Relationship Management (CRM) platform, file repositories, a reporting application, and Marketing Cloud, compromising data of 1.2 million students, alumni, and donors. Hackers claimed to have stolen donor records, bank transactions, and internal memos, threatening to sell or leak the data for financial gain. While Penn restored systems and engaged law enforcement (FBI) and CrowdStrike for investigation, the full scope of exposed data remains unverified. The attack involved mass phishing emails sent from the Graduate School of Education’s system, demanding ransom and criticizing the university’s security. Victims are now filing lawsuits, alleging negligence in safeguarding personal information. The university has yet to confirm the exact data stolen but advises affected individuals to enable credit freezes, multi-factor authentication (MFA), and password resets as precautionary measures.

In late October 2025, the University of Pennsylvania suffered a major data breach after a hacker compromised an employee’s PennKey SSO account, gaining unauthorized access to critical systems, including the VPN, Salesforce, analytics platforms, and internal files. The attacker exfiltrated sensitive personally identifiable information (PII) of approximately 1.2 million students, alumni, and donors, including names, dates of birth, addresses, phone numbers, financial/demographic data (estimated net worth, donation history), race, religion, and sexual orientation. The breach escalated when the hacker sent offensive emails to hundreds of thousands of recipients via Penn’s mailing list and publicly leaked samples of stolen data as proof. The incident was reported to the FBI, and the university issued a cybersecurity notice on November 4, 2025. Victims face risks of identity theft, phishing, and financial fraud, with legal firms (e.g., Shamis & Gentile P.A.) investigating potential class-action lawsuits for compensation covering credit monitoring, identity protection, and financial losses.

The University of Pennsylvania (UPenn) suffered a cyberattack involving sophisticated identity impersonation (social engineering), allowing attackers to gain unauthorized access to internal systems linked to fundraising and alumni databases. The breach was detected after a fraudulent email was sent from Penn’s Graduate School of Education, triggering an investigation that uncovered the intrusion.Former students have filed lawsuits, alleging UPenn failed to adequately protect their personal, academic, and financial records, which may have been exposed. While the university contained the breach and restored affected systems, the long-term risks remain unclear, including potential misuse of stolen data (e.g., identity theft, fraud). The FBI is investigating, and UPenn has enlisted CrowdStrike for forensic analysis and defense reinforcement.The incident has damaged UPenn’s reputation, with alumni demanding transparency on what data was compromised, notification timelines, and preventive measures. The breach highlights broader concerns about how long universities must safeguard alumni data and the risks of storing decades-old records on interconnected systems. Legal outcomes may influence cybersecurity standards for higher education institutions nationwide.

The University of Pennsylvania (Penn) suffered a significant data breach targeting its information systems, compromising the confidential data of 1.2 million students, alumni, and donors. The breach, disclosed on November 2, 2024, led to a wave of class-action lawsuits from graduates alleging negligence in cybersecurity measures. Plaintiffs claim Penn failed to maintain adequate security systems, monitor for intrusions, or ensure third-party vendors followed proper protocols. The stolen data reportedly includes Personally Identifiable Information (PII), though the full scope remains under investigation. Penn confirmed the breach was contained but has not detailed the exact nature of the exposed data. Lawsuits argue the impact is far broader than acknowledged, with long-term repercussions expected for affected individuals, including potential identity theft, financial fraud, or reputational harm. The incident underscores systemic vulnerabilities in Penn’s data protection framework, raising concerns over compliance and trust among stakeholders.

The University of Pennsylvania (UPenn) suffered a significant cybersecurity breach in late October 2023, where hackers infiltrated inadequately secured email systems and exfiltrated personally identifiable information (PII) of students, alumni, donors, and employees. The breach exposed internal documents, including bank transaction receipts, donor memos, and sensitive PII, which were later dumped publicly. A class-action lawsuit filed by a Penn alumnus alleges negligence, citing UPenn’s failure to implement robust security measures, monitor systems, or enforce vendor safeguards. The attackers, motivated by targeting ultra-high-net-worth individuals, exploited weak authentication protocols. The University reported the incident to the FBI and acknowledged the leak’s severity, though the full scope of misuse (e.g., identity theft, financial fraud) remains unresolved. The lawsuit argues UPenn violated the Federal Trade Commission Act by failing to protect data, with plaintiffs claiming lifelong risks from the exposed information.