The University of Pennsylvania confirmed that a hacker broke into and stole university data as part of a cyberattack, which also hijacked its official @upenn.edu email addresses to send harassing messages to members of the community. The incident involved development and alumni relations systems, and investigators are working to determine what information was stolen.
What the University Disclosed About the Breach
The university said in a statement to alumni and others that some of its systems used by advancement were breached through what is known as a social engineering scam. Staff managed to halt the intrusion and shut down unauthorized access, but not before the attacker moved data out of its systems and sent a phony mass email composed in broken English via legitimate university addresses. Penn said it will notify people whose information was involved, as required by law, but has not disclosed how many people are affected or what types of data were accessed.
- What the University Disclosed About the Breach
- How the attackers entered Penn’s systems and email
- Alumni and donor data may be at risk from the breach
- Context from other campus breaches and recent trends
- What to do if you are affected by the Penn data breach
- What to watch next as Penn investigates the incident
How the attackers entered Penn’s systems and email
Social engineering is still the most reliable on-ramp for intruders. Instead of taking advantage of an unpatched server, attackers typically dupe someone into providing credentials or access via something like a “push fatigue” approval. One of the consistent findings over the years in Verizon’s long-running Data Breach Investigations Report has been how much breaches revolve around the human element. Universities — large, decentralized, and email-rich — are targets of opportunity.
The fact that the blast was sent through real university email accounts points to the attacker having valid credentials and strongly indicates access to some kind of mailing list or contact tools involving links that relate to outreach with alumni. In related scenarios, attackers also utilize delegated “send-as” instruments in email servers to send fraudulent messages that are otherwise almost impossible to distinguish from genuine ones.
Alumni and donor data may be at risk from the breach
Penn has not disclosed the nature of the material that was stolen, but the student newspaper The Daily Pennsylvanian reported last month that the hacker claimed possession of documents, donor information, bank receipts for transactions, and PII. Fundraising platforms frequently house names, contact information, giving history, event attendance, and notes from outreach work. At this point, the types of data involved (financial account numbers, Social Security numbers, government IDs) will determine the severity of identity theft risk and the degree to which notification (general public or targeted) and remediation are necessary under state laws and FERPA (if education records are at issue).
The attacker also posted rhetoric about affirmative action and legacy admissions while claiming a financial motivation. There can be mixed motives in modern attacks: extortion and pressure campaigns involving data leaks often piggyback on political messaging to raise the stakes for public attention and drive institutions toward payment.
Context from other campus breaches and recent trends
Higher education has been plagued by credential theft, ransomware, and wide-scale data-theft events linked to third-party software. Columbia University reported one hack in which information about some 102,000 students, applicants, and alumni was improperly accessed using stolen credentials; another breach conducted without theft of any source data exposed personal information on about 768,000 applicants for internships and employment. In a separate incident, dozens of universities faced fallout from the broad MOVEit supply-chain compromise exposing them through vendors — examples of exposure that can be felt far outside campus networks.
Business email compromise is still the most lucrative for criminals, according to the FBI’s Internet Crime Complaint Center, which just released its year-end statistics.
In higher education, groups like EDUCAUSE have listed cybersecurity and privacy among the top institutional risks for years due to complex federated identity systems, legacy applications, and a proliferation of third-party integrations.
What to do if you are affected by the Penn data breach
Unless and until Penn gives official notice, alumni and affiliates should assume that their contact information or correspondence was compromised, and use care when responding to unexpected emails — even ones with familiar @upenn.edu addresses. Measures that mitigate risk include:
- Changing passwords for university accounts
- Activating phishing-resistant multifactor authentication (where available)
- Creating strong, unique passphrases stored by a legitimate password manager
If there’s a financial or identity data tie-in, it could be worth taking additional steps:
- Placing a credit freeze with the major bureaus
- Monitoring bank and card statements and setting up transaction alerts
- Signing up for credit monitoring if it is offered
Watch out for follow-on attacks that mention the breach; attackers frequently sell stolen data to other criminals, who use the information in well-crafted phishing and fraudulent donation solicitations.
What to watch next as Penn investigates the incident
Open questions remain about the number of affected people, whether student education records and payroll details were accessed in the attack, and whether the attacker intends to publish data on any leaking site. Penn will also be under close scrutiny around email security controls (like DMARC enforcement and phishing-resistant MFA), access management for advancement systems, and separation between development environments and institutional core records.
For colleges in general, the incident underscores a formula that is clearly spelled out for them. Key steps include:
- Shrinking the attack surface by pruning permanent administrative privileges
- Using MFA backed with hardware security keys for high-risk roles
- Reducing “send-as” and API permissions in email and CRM systems
- Rehearsing response plans involving expedited removal of malicious mail
The more institutions treat their advancement and alumni systems as valuable assets, the less likely it is that a single phish will end with community-wide compromise.
