Company Details
university-of-pennsylvania
22,413
573,411
6113
upenn.edu
1047
UNI_5783928
Completed


University of Pennsylvania Company CyberSecurity Posture
upenn.eduThe University of Pennsylvania is one of the oldest universities in America and, as a member of the Ivy League, one of the most prestigious institutions of higher learning in all the world. Penn is home to 12 schools including the School of Arts and Sciences, the School of Nursing, the School of Engineering and Applied Science and the Wharton School of Business, as well as several graduate and professional schools such as the Perelman School of Medicine.
Company Details
university-of-pennsylvania
22,413
573,411
6113
upenn.edu
1047
UNI_5783928
Completed
Between 650 and 699

UP Global Score (TPRM)XXXX

Description: The University of Pennsylvania (Penn) has announced a new data breach after attackers stole documents containing personal information from its Oracle E-Business Suite servers in August. The private Ivy League research university was founded in 1740 and has 5,827 faculty members and 29,109 students, with an 8:1 student-to-faculty ratio. It also has an academic operating budget of $4.7 billion and an endowment of $24.8 billion as of June 30, 2025. The University of Pennsylvania disclosed another breach in late October 2025, after a hacker compromised internal systems and stole data on Penn's development and alumni activities. The attacker claimed they exfiltrated personal information belonging to roughly 1.2 million students, alumni, and donors. In recent weeks, other Ivy League schools have been targeted by a series of voice phishing attacks, with Harvard University and Princeton University also reporting that a hacker breached systems used for development and alumni activities to steal the personal information of students, alumni, donors, staff, and faculty. Penn's Oracle EBS breach In a breach notification letter filed with the office of Maine's Attorney General this week, Penn noted that the attackers exploited a previously unknown security vulnerability in the Oracle E-Business Suite (EBS) financial application (also known as a zero-day flaw) to steal the personal information belonging to 1,488 individuals. However, the number of people potentially impacted by the i
Description: The University of Pennsylvania (Penn) suffered a cybersecurity breach in which an unauthorized individual infiltrated its network and potentially exfiltrated personally identifiable information (PII) of over one million donors. The compromised data includes donation histories, donor net worth, and demographic details, though the full scope of misuse remains under investigation. The incident has prompted a class-action investigation by Lynch Carpenter, LLP, a national law firm specializing in data privacy litigation, suggesting significant legal and reputational risks for Penn. Affected individuals may be eligible for compensation, indicating potential financial liabilities for the institution. The breach underscores vulnerabilities in Penn’s cybersecurity defenses, particularly in safeguarding high-value donor data, which could erode trust among stakeholders and donors. The long-term impact may include regulatory scrutiny, operational disruptions, and costs associated with remediation, notification, and legal settlements.


No incidents recorded for University of Pennsylvania in 2026.
No incidents recorded for University of Pennsylvania in 2026.
No incidents recorded for University of Pennsylvania in 2026.
UP cyber incidents detection timeline including parent company and subsidiaries

The University of Pennsylvania is one of the oldest universities in America and, as a member of the Ivy League, one of the most prestigious institutions of higher learning in all the world. Penn is home to 12 schools including the School of Arts and Sciences, the School of Nursing, the School of Engineering and Applied Science and the Wharton School of Business, as well as several graduate and professional schools such as the Perelman School of Medicine.


University of Florida is a major, public, comprehensive, land-grant, research university. The state's oldest, largest and most comprehensive university, it is among the nation's most academically diverse public universities. University of Florida has a long history of established programs in interna

For more than 20 years, we have remained committed to making a positive impact in the communities we serve, by providing accessible, high-quality undergraduate, graduate, and specialized degree programs. We know that when our students succeed, countries prosper, and societies benefit. We take very

Galileo Global Education, world leader in independent higher education with 210,000 students, 61 schools and 106 campuses in 18 countries, placed employability and innovation at the heart of its strategy for 15 years. Galileo Global Education's mission is to enable everyone, regardless of their star

Washington State University is a nationally recognized land-grant research university, founded in Pullman in 1890. WSU’s statewide system includes campuses in Pullman, Spokane, Everett, Tri-Cities and Vancouver, with extension and research offices in every county of the state, and a nationally ranke

WGU, www.wgu.edu, is an online university for the 21st century. We are driven by a mission to expand access to higher education through online, competency-based degree programs. Since its establishment in 1997, WGU has grown into a national university, serving more than 180,000 students from all 50

The University of New South Wales (UNSW) is one of Australia's leading research and teaching universities. Established in 1949, UNSW has expanded rapidly and now has more than 52,000 students, including more than 14,000 international students from over 130 different countries. UNSW offers more tha

As the largest university in one of the nation’s most iconic cities, Temple educates diverse future leaders from across Philadelphia, the country and the world who share a common drive to learn, prepare for their careers and make a real impact. Founded as a night school by Russell Conwell in 1884, T

The University of Cincinnati, top 5 university for co-op and internships, offers students a balance of academic excellence and real-world experience. Since its founding in 1819, UC has been the source of many discoveries creating positive change for society, including the first antihistamine, the fi

The University of Alberta is one of Canada’s top teaching and research universities, with an international reputation for excellence across the humanities, sciences, creative arts, business, engineering, and health sciences. Home to more than 39,000 students and 15,000 faculty and staff, the univers
.png)
Multiple lawsuits have been filed against Princeton in the wake of a widespread cybersecurity breach.
Penn is investigating a cybersecurity breach of its Oracle E-Business Suite servers that compromised the personal information of...
The University of Pennsylvania (UPenn) has confirmed that it suffered a data breach last month, making it the second Ivy League school to...
The University of Pennsylvania has become the latest victim of Clop's smash-and-grab spree against Oracle's E-Business Suite (EBS) customers...
The University of Pennsylvania (Penn) has confirmed a new data breach after attackers stole documents containing personal information from...
Harvard University, Princeton University and the University of Pennsylvania have all disclosed data breaches that compromised sensitive...
Following last month's cybersecurity breach, Penn implemented a new mandatory information security training for all faculty and staff on...
Hackers are ramping up attacks on academic institutions to access valuable data and to demand ransoms.
Recent cyberattacks at prominent institutions show how vulnerable higher education systems are and why they struggle to defend themselves.

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
The official website of University of Pennsylvania is http://www.upenn.edu/.
According to Rankiteo, University of Pennsylvania’s AI-generated cybersecurity score is 678, reflecting their Weak security posture.
According to Rankiteo, University of Pennsylvania currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
According to Rankiteo, University of Pennsylvania has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.
According to Rankiteo, University of Pennsylvania is not certified under SOC 2 Type 1.
According to Rankiteo, University of Pennsylvania does not hold a SOC 2 Type 2 certification.
According to Rankiteo, University of Pennsylvania is not listed as GDPR compliant.
According to Rankiteo, University of Pennsylvania does not currently maintain PCI DSS compliance.
According to Rankiteo, University of Pennsylvania is not compliant with HIPAA regulations.
According to Rankiteo,University of Pennsylvania is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
University of Pennsylvania operates primarily in the Higher Education industry.
University of Pennsylvania employs approximately 22,413 people worldwide.
University of Pennsylvania presently has no subsidiaries across any sectors.
University of Pennsylvania’s official LinkedIn profile has approximately 573,411 followers.
University of Pennsylvania is classified under the NAICS code 6113, which corresponds to Colleges, Universities, and Professional Schools.
No, University of Pennsylvania does not have a profile on Crunchbase.
Yes, University of Pennsylvania maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/university-of-pennsylvania.
As of January 24, 2026, Rankiteo reports that University of Pennsylvania has experienced 2 cybersecurity incidents.
University of Pennsylvania has an estimated 15,184 peer or competitor companies worldwide.
Incident Types: The types of cybersecurity incidents that have occurred include Breach.
Detection and Response: The company detects and responds to cybersecurity incidents through an communication strategy with public disclosure via press release; legal firm (lynch carpenter, llp) notified affected individuals for potential claims, and communication strategy with breach notification letter filed with maine's attorney general..
Title: University of Pennsylvania Data Breach (2025)
Description: An unauthorized person gained access to the University of Pennsylvania's (Penn) network and may have acquired records containing personally identifiable information (PII) of over one million donors, including donation history, net worth, and demographic details. Lynch Carpenter, LLP is investigating potential claims related to this breach.
Date Publicly Disclosed: 2025-11-04
Type: Data Breach
Threat Actor: Unauthorized person
Title: University of Pennsylvania Oracle E-Business Suite Data Breach
Description: The University of Pennsylvania (Penn) announced a data breach after attackers exploited a zero-day vulnerability in its Oracle E-Business Suite (EBS) servers in August 2025, stealing personal information of 1,488 individuals. A separate breach in late October 2025 involved a hacker compromising internal systems and exfiltrating data on roughly 1.2 million students, alumni, and donors related to development and alumni activities. The incident is part of a broader series of voice phishing attacks targeting Ivy League institutions, including Harvard and Princeton.
Date Publicly Disclosed: 2025-10-late
Type: Data Breach
Attack Vector: Zero-Day Vulnerability in Oracle E-Business SuiteVoice Phishing (for broader Ivy League attacks)
Vulnerability Exploited: Unknown (zero-day) vulnerability in Oracle E-Business Suite (EBS)
Common Attack Types: The most common types of attacks the company has faced is Breach.
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Zero-day vulnerability in Oracle EBS (August)Voice phishing (broader Ivy League attacks).

Data Compromised: Donation history, Donor net worth, Demographic details
Brand Reputation Impact: Potential reputational damage due to exposure of sensitive donor information
Legal Liabilities: Lynch Carpenter, LLP is investigating claims for potential compensation; class action lawsuit possible
Identity Theft Risk: High (PII exposed)

Data Compromised: Personal information of 1,488 individuals (august breach), Personal information of ~1.2 million students, alumni, and donors (october breach)
Systems Affected: Oracle E-Business Suite (EBS) serversInternal systems (development and alumni activities)
Brand Reputation Impact: Potential reputational damage due to breach affecting students, alumni, and donors
Identity Theft Risk: High (personal information exposed)
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Donation History, Donor Net Worth, Demographic Details, and Personal information.

Entity Name: University of Pennsylvania (Penn)
Entity Type: Educational Institution
Industry: Higher Education
Location: Philadelphia, Pennsylvania, USA
Customers Affected: 1,000,000+ (donors)

Entity Name: University of Pennsylvania (Penn)
Entity Type: Educational Institution (Private Ivy League University)
Industry: Higher Education
Location: Philadelphia, Pennsylvania, USA
Size: 29,109 students, 5,827 faculty members
Customers Affected: 1,488 individuals (August breach); ~1.2 million students, alumni, and donors (October breach)

Entity Name: Harvard University
Entity Type: Educational Institution (Private Ivy League University)
Industry: Higher Education
Location: Cambridge, Massachusetts, USA

Entity Name: Princeton University
Entity Type: Educational Institution (Private Ivy League University)
Industry: Higher Education
Location: Princeton, New Jersey, USA

Communication Strategy: Public disclosure via press release; legal firm (Lynch Carpenter, LLP) notified affected individuals for potential claims

Communication Strategy: Breach notification letter filed with Maine's Attorney General

Type of Data Compromised: Donation history, Donor net worth, Demographic details
Number of Records Exposed: 1,000,000+
Sensitivity of Data: High (PII, financial details)
Data Exfiltration: Possible (unauthorized access and acquisition of records)

Type of Data Compromised: Personal information
Number of Records Exposed: 1,488 (August breach), ~1,200,000 (October breach)
Sensitivity of Data: High (personal information of students, alumni, donors, faculty, and staff)

Data Exfiltration: True

Legal Actions: Potential class action lawsuit (under investigation by Lynch Carpenter, LLP)

Regulatory Notifications: Maine Attorney General (breach notification letter)
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Potential class action lawsuit (under investigation by Lynch Carpenter, LLP).

Source: University of Pennsylvania Breach Notification (Maine AG Office)

Source: University of Pennsylvania Public Disclosure (October 2025)
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: GlobeNewswire Press ReleaseDate Accessed: 2025-11-04, and Source: University of Pennsylvania Breach Notification (Maine AG Office), and Source: University of Pennsylvania Public Disclosure (October 2025).

Investigation Status: Ongoing (Lynch Carpenter, LLP investigating claims)

Investigation Status: Ongoing (as of late October 2025)
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public disclosure via press release; legal firm (Lynch Carpenter, LLP) notified affected individuals for potential claims and Breach notification letter filed with Maine's Attorney General.

Stakeholder Advisories: Affected donors advised to contact Lynch Carpenter, LLP for legal review
Customer Advisories: Donors whose PII may have been compromised are encouraged to seek legal consultation via Lynch Carpenter, LLP

Customer Advisories: Breach notification letters sent to affected individuals
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Affected donors advised to contact Lynch Carpenter, LLP for legal review, Donors whose PII may have been compromised are encouraged to seek legal consultation via Lynch Carpenter, LLP and Breach notification letters sent to affected individuals.

High Value Targets: Donor Records, Financial Details,
Data Sold on Dark Web: Donor Records, Financial Details,

Entry Point: Zero-Day Vulnerability In Oracle Ebs (August), Voice Phishing (Broader Ivy League Attacks),
High Value Targets: Development And Alumni Activity Systems, Personal Data Of Students, Alumni, And Donors,
Data Sold on Dark Web: Development And Alumni Activity Systems, Personal Data Of Students, Alumni, And Donors,

Root Causes: Zero-Day Vulnerability In Oracle Ebs, Potential Voice Phishing (For Broader Attacks),
Last Attacking Group: The attacking group in the last incident was an Unauthorized person.
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-10-late.
Most Significant Data Compromised: The most significant data compromised in an incident were donation history, donor net worth, demographic details, , Personal information of 1,488 individuals (August breach), Personal information of ~1.2 million students, alumni, and donors (October breach) and .
Most Significant System Affected: The most significant system affected in an incident was Oracle E-Business Suite (EBS) serversInternal systems (development and alumni activities).
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were demographic details, Personal information of ~1.2 million students, alumni, and donors (October breach), donation history, donor net worth, Personal information of 1 and488 individuals (August breach).
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 2.2M.
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Potential class action lawsuit (under investigation by Lynch Carpenter, LLP).
Most Recent Source: The most recent source of information about an incident are GlobeNewswire Press Release, University of Pennsylvania Breach Notification (Maine AG Office) and University of Pennsylvania Public Disclosure (October 2025).
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (Lynch Carpenter, LLP investigating claims).
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Affected donors advised to contact Lynch Carpenter, LLP for legal review, .
Most Recent Customer Advisory: The most recent customer advisory issued were an Donors whose PII may have been compromised are encouraged to seek legal consultation via Lynch Carpenter, LLP and Breach notification letters sent to affected individuals.
.png)
Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.
Azure Entra ID Elevation of Privilege Vulnerability
Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. This issue has been fixed in version 0.10.0.
Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authenticated user to execute arbitrary system commands on the host server by injecting shell metacharacters into backup filenames. The BackupManager fails to sanitize the filenames of uploaded backups. The system persists user-uploaded files directly to the host filesystem using the raw originalname provided in the request. This allows an attacker to stage a file containing shell metacharacters (e.g., $(id).tar.gz) at a predictable path, which is later referenced during the restore process. The successful storage of the file is what allows the subsequent restore command to reference and execute it. This issue has been fixed in version 4.7.0.

Get company history
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.