University of Pennsylvania security incident history
Hacking, data breaches and other security incidents involving University of Pennsylvania, with related coverage.
University of Pennsylvania hit by repeated cyberattacks
The University of Pennsylvania suffered repeated cyberattacks. Experts said the university needed to review its security framework.
Read on The Daily Pennsylvanian ↗Hackers claim 300,000 University of Pennsylvania users affected by Canvas hack
300KImpact: Claimed impact on more than 300,000 users
A cybercriminal group claimed that more than 300,000 University of Pennsylvania users were affected by the Canvas hack. Whether the scale of the damage has been verified, the specific impacts and the university's response have not been confirmed.
Read on The Daily Pennsylvanian ↗University of Pennsylvania Graduate School of Education email hack
10Impact: Fewer than 10 people
An email hack at the University of Pennsylvania Graduate School of Education affected fewer than 10 people. The number affected was confirmed in a newly submitted filing, and the specific timing and response have not been confirmed.
Read on The Daily Pennsylvanian ↗University of Pennsylvania personal data exposed in Oracle-related hack
Impact: Personal records exposed
The University of Pennsylvania confirmed a new data breach following the Oracle hack. The university is investigating a data breach of business software that affected personal records.
Related reports: 2 →University of Pennsylvania account takeover leaks alumni and donor data
1.2MImpact: Leak of alumni- and donation-related data; attackers claim 1.2 million donor records
In October 2025, a University of Pennsylvania employee account was hijacked through a social engineering attack, compromising alumni- and donation-related systems and data. The attackers sent mass offensive emails from the account and claimed to have stolen 1.2 million donor records. The university said it reported the incident to the FBI, contained the breach and completed its investigation in February 2026. The attackers later released additional internal documents.
Related reports: 27 · last report →