University of Pennsylvania

The University of Pennsylvania is probing a security incident where a threat actor allegedly compromised a university email account to send offensive messages to students and alumni. The attacker has also claimed unauthorized access to **1.2 million donor records** and **internal files**, raising concerns about the exposure of sensitive personal and financial data. While the full scope of the breach is under investigation, the potential leak of donor information—including names, contact details, and possibly financial contributions—poses significant reputational and operational risks. The incident highlights vulnerabilities in the university’s email security and data protection measures, with potential long-term consequences for trust among donors, alumni, and the broader academic community. The breach may also trigger regulatory scrutiny and legal liabilities if personal data was mishandled.

Source: https://www.teiss.co.uk/news/university-of-pennsylvania-investigates-alleged-data-breach-affecting-12-million-records-16651

TPRM report: https://www.rankiteo.com/company/university-of-pennsylvania-coursera

"id": "uni1033710110425",
"linkid": "university-of-pennsylvania-coursera",
"type": "Breach",
"date": "5/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': ['students',
                                               'alumni',
                                               'donors (1.2 million records)'],
                        'industry': 'higher education',
                        'location': 'Philadelphia, Pennsylvania, USA',
                        'name': 'University of Pennsylvania',
                        'type': 'educational institution'}],
 'data_breach': {'data_exfiltration': 'claimed (unverified)',
                 'number_of_records_exposed': '1.2 million',
                 'type_of_data_compromised': ['donor records',
                                              'internal files']},
 'description': 'The University of Pennsylvania is investigating reports that '
                'a threat actor used a university email account to send '
                'offensive messages to students and alumni and has claimed '
                'access to 1.2 million donor records and internal files.',
 'impact': {'brand_reputation_impact': 'potential (due to offensive messages '
                                       'and data breach claims)',
            'data_compromised': ['donor records', 'internal files'],
            'systems_affected': ['email account']},
 'initial_access_broker': {'entry_point': 'compromised email account',
                           'high_value_targets': ['donor records',
                                                  'internal files']},
 'investigation_status': 'ongoing',
 'response': {'incident_response_plan_activated': 'under investigation'},
 'title': 'University of Pennsylvania Investigates Alleged Data Breach '
          'Affecting 1.2 Million Records',
 'type': ['data breach', 'unauthorized access', 'email compromise']}