HackingEducationEducationStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)PIIMediumContained

The Trustees of the University of Pennsylvania

bd_5fa5e741d0d86224 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 31, 2025

Filed

Apr 15, 2026

To disclose

24 weeks

Affected

5,878state residents only

Linked

17 filings

Confidence

71%

Full breach record for The Trustees of the University of Pennsylvania →3 incidents on file

The University of Pennsylvania reported a cyberattack on Oct 31, 2025, involving unauthorized access via a user account. Files containing contact and demographic info of alumni, donors, students, and employees were downloaded. 5,878 Washington residents were notified. Law enforcement was notified and an investigation launched.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d24 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 24 weeks / 166 days

Oct 30, 2025

Begins

Oct 31, 2025

Discovered

Apr 15, 2026

Filed

vs. sector median

+17 wks slower

This filing is one of 17 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteshinyhuntersbd_20d98f86cadb16022026-02-04 · +70dVerified by operator

Regulatory filings (9) · sorted by filing gap

Oregon State AGbd_52860701b7a833ff2025-12-22 · +114dVerified by operator
New Hampshire State AGbd_04392877ff003a222025-12-04 · +132dVerified
Texas State AGbd_e679c6a24510eaf92025-12-03 · +133dVerified by operator
Massachusetts State AGbd_8ad1850d7141bc9a2025-12-02 · +134dVerified by operator

Show 5 more filings ↓up to 135d gap

California State AGbd_194bd163b527a3352025-12-01 · +135dVerified by operator
Montana State AGbd_1fae715254418c002025-12-01 · +135dVerified by operator
Iowa State AGbd_3340eceed80aa4a62025-12-01 · +135dVerified by operator
South Carolina State AGbd_36bdda19f39a3c942025-12-01 · +135dVerified
Delaware State AGbd_5e138ad76c39ef7a2025-12-01 · +135dVerified by operator

Showing first 10 of 16 linked disclosures.

Name: The Trustees of the University of Pennsylvania
norm: the trustees of the university of pennsylvania

Name: The Trustees of the University of Pennsylvania
norm: the trustees of the university of pennsylvania
Industry: Educationllm

Discovered: Oct 31, 2025
Breach occurred: Oct 30, 2025 – Oct 31, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Apr 15, 2026
Affected individuals: 5,878state-resident count only
Data types: Identity (basic)PII
Data elements: NameDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcement
Initial access: valid_credentials

During the incident: Immediately terminated the unauthorized access
Launched an investigation with the assistance of cybersecurity experts
Notified law enforcement
Changes made: Taking steps to improve information security program and systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(166 days from discovery to filing)
Compliance flags: WA AG >90dLeak >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

California State AGDec 1 · first

Montana State AGDec 1 · first

Iowa State AGDec 1 · first

South Carolina State AGDec 1 · first

Delaware State AGDec 1 · first

Massachusetts State AG+1d

Texas State AG+2d

New Hampshire State AG+3d

Oregon State AG+21d

Washington State AG+135d · this page

Pattern: first filing Dec 1 (CA), last Apr 15 (WA) — a 135-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 16 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37706.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 15, 2026
Raw hash: 5fc58ac883d39b4160671dbb50717719e5e17a549e19141eb60219eec2fe5995

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityThe Trustees of the University of Pennsylvania

Victim entityThe Trustees of the University of Pennsylvania

Incidentdiscovered Oct 31, 2025

Stated responseImmediately terminated the unauthorized access

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com