The Trustees of the University of Pennsylvania

The University of Pennsylvania notified affected individuals of a data security incident involving its third-party Oracle E-Business Suite (EBS) application. The incident involved a previously unknown security vulnerability (zero-day/n-day) exploited by an external actor to gain unauthorized access and exfiltrate personal information, including government-issued identifiers and basic PII. Penn discovered the unauthorized access on November 11, 2025, and notified law enforcement. No evidence of misuse was found at the time of notification. Remediation included applying Oracle security patches, reinforcing systems, and offering 24 months of complimentary credit monitoring via Experian.