Breachesby GlyphUniversity of Pennsylvania
Disclosed Oct 31, 2025442,500 affectedConfirmed
Hackers breach UPenn systems, send mass emails and steal donor data
Hackers used Penn email accounts to send offensive mass emails to alumni and students and claimed to have stolen donor data; Penn later confirmed data was stolen, and in December disclosed a separate breach through Oracle E-Business Suite.
What is known
| People affected | 442,500 (as reported by the organization) |
|---|---|
| Disclosed | Oct 31, 2025 |
| Discovered | Sep 29, 2025 |
| Happened | Aug 9, 2025 |
| Attack | Hacking |
| Data exposed | NamesCredentials and tokensDates of birthEmailsFinancialEmploymentAddressesPhone numbersOtherSocial Security numbersPayment cards |
| Sector | Education · US |
| Status | Confirmed |
| Check your email | Have I Been Pwned |
Sources
California Attorney General breach notice: University of PennsylvaniaWashington Attorney General breach notice: University of PennsylvaniaNotice letter filed with the Delaware DOJ: University of PennsylvaniaOregon DOJ breach notice: University of PennsylvaniaHave I Been Pwned: University of PennsylvaniaHackers threaten to leak data after breaching University of Pennsylvania to send mass emailsUniversity of Pennsylvania confirms hacker stole data during cyberattackUniversity of Pennsylvania confirms data stolen in cyberattackTexas Attorney General data security breach report BR-0004699: University of PennsylvaniaVermont Attorney General: 2025-12-01 The University of Pennsylvania Data Breach Notice to ConsumersIndiana Attorney General 2025 data breach report: University of Pennsylvania
Notices filed
Other breaches at University of Pennsylvania
History of this record
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2025.pdfby backfillSource
empty to https://ago.vermont.gov/document/2025-12-01-university-pennsylvania-data-breach-notice-consumersby backfillSource
["names","credentials","dob","emails","financial","employment","addresses","phone","other"] to ["names","credentials","dob","emails","financial","employment","addresses","phone","other","ssn","payment-card"]by backfillSource
["names","credentials","dob","emails","financial","employment","addresses"] to ["names","credentials","dob","emails","financial","employment","addresses","phone","other"]by seedSource
2025-12-01 to 2025-10-31by seedSource
In October 2025, the University of Pennsylvania was the victim of a data breach followed by a ransom demand , largely affecting its donor database. After the incident, the attackers sent inflammatory emails to some victims. The data was lat to Hackers used Penn email accounts to send offensive mass emails to alumni and students and claimed to have stolen donor data; Penn later confirmed data was stolen, and in December disclosed a separate breach through Oracle E-Business Suite.by seedSource
empty to Hackers breach UPenn systems, send mass emails and steal donor databy seedSource
empty to UniversityOfPennsylvaniaby backfillSource
["names","credentials"] to ["names","credentials","dob","emails","financial","employment","addresses"]by backfillSource
empty to In October 2025, the University of Pennsylvania was the victim of a data breach followed by a ransom demand , largely affecting its donor database. After the incident, the attackers sent inflammatory emails to some victims. The data was latby backfillSource
[] to ["names","credentials"]by backfillSource
empty to organizationby backfillSource
empty to 442500by backfillSource
unknown to hackingby backfillSource
empty to 2025-09-29by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.