University of Pennsylvania account takeover leaks alumni and donor data
In October 2025, a University of Pennsylvania employee account was hijacked through a social engineering attack, compromising alumni- and donation-related systems and data. The attackers sent mass offensive emails from the account and claimed to have stolen 1.2 million donor records. The university said it reported the incident to the FBI, contained the breach and completed its investigation in February 2026. The attackers later released additional internal documents.
Key facts
- Affected organization
- University of Pennsylvania
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Leak of alumni- and donation-related data; attackers claim 1.2 million donor records
- Cause / method
- Social engineering attack used to hijack an employee account and infiltrate alumni- and donation-related systems
- Location
- United States
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
Timeline
- Offensive emails were sent en masse from a university account, prompting the university to launch an investigation.
- The attackers claimed to have stolen data on 1.2 million people, and alumni filed a class action lawsuit.
- Donor records and internal memos were released, and the university said it had reported the incident to the FBI.
- The university confirmed the data theft and said the breach had been contained.
- The university said it had completed its investigation into the October 2025 breach.
- The attackers claimed they released the data because the university refused to pay a $1 million ransom.
27 related reports
- Penn investigating mass emails sent from University accounts in apparent security breach
- Penn reports GSE hack, ‘breach of data’ to FBI
- UPenn investigating security breach after vulgar emails seemingly sent from school account
- Penn email system gets hacked, message calls university ‘elitist institution’ with ‘terrible security practices’
- Vulgar message sent from “hacked” UPenn email
- Hackers threaten to leak data after breaching University of Pennsylvania to send mass emails
- ‘We got hacked’ emails threaten to leak University of Pennsylvania data
- Penn says it wasn't hacked after a vulgar email was sent to campus community
- Penn alum files class-action suit alleging University ‘negligence’ led to cybersecurity breach
- Hacker claiming responsibility for spam Penn emails stole data from 1.2 million people, report says
- Penn hacker claims to have stolen 1.2 million donor records in data breach
- Alleged Penn hackers release donor records, confidential University memos following data breach
- University of Pennsylvania says it has called FBI over data breach
- Penn Data Breach Involves Decades of Student and Alumni Information
- Penn says data breach is ‘contained’ as extent of stolen data remains unclear
- Penn faces wave of alumni litigation following mass data breach
- Musk and Trump both went to Penn—now hacked by someone sympathetic to their cause
- University of Pennsylvania confirms hacker stole data during cyberattack
- UPenn Confirms Cyber Attack as Hackers Claim Data on 1.2M People
- University of Pennsylvania confirms data stolen in cyberattack
- University of Pennsylvania Data Breach Reportedly Impacts 1.2M
- What Penn’s leaked internal ‘talking points’ say about recent University controversies
- Halloween email scare exposes UPenn data breach, leading to class action lawsuit
- Penn says investigation into October 2025 cybersecurity breach is ‘complete’
- Cybercrime group claims responsibility for Penn email hack, leaks additional internal files
- New files leaked in data breach show how Penn tracked years of donor activity
- Penn data leaked after University refused to pay $1 million ransom, hacker group says
Other incidents at University of Pennsylvania
University of Pennsylvania hit by repeated cyberattacks
The University of Pennsylvania suffered repeated cyberattacks. Experts said the university needed to review its security framework.
Read on The Daily Pennsylvanian ↗Hackers claim 300,000 University of Pennsylvania users affected by Canvas hack
300KImpact: Claimed impact on more than 300,000 users
A cybercriminal group claimed that more than 300,000 University of Pennsylvania users were affected by the Canvas hack. Whether the scale of the damage has been verified, the specific impacts and the university's response have not been confirmed.
Read on The Daily Pennsylvanian ↗University of Pennsylvania Graduate School of Education email hack
10Impact: Fewer than 10 people
An email hack at the University of Pennsylvania Graduate School of Education affected fewer than 10 people. The number affected was confirmed in a newly submitted filing, and the specific timing and response have not been confirmed.
Read on The Daily Pennsylvanian ↗University of Pennsylvania personal data exposed in Oracle-related hack
Impact: Personal records exposed
The University of Pennsylvania confirmed a new data breach following the Oracle hack. The university is investigating a data breach of business software that affected personal records.
Related reports: 2 →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.