The Trustees of the University of Pennsylvania

The Trustees of the University of Pennsylvania, a education sector entity reported a other incident to the Washington Attorney General. The organization became aware of the incident on 2025-10-31 and filed notice on 2026-04-15. 5,878 Washington residents were affected. 166 days elapsed between awareness and notification. 1 days to identify the breach. 0 days to contain the breach.

Records: 1.2M Records | Updated: 04 Feb 2026 | Note: Make the right decision, don't be the next headline. | This is the direct result of advisors advising you against paying a ransom. It has the opposite effect. Do NOT provoke us again and pay the ransom when we contact you.

University of Pennsylvania reported a data breach to the Oregon Attorney General. The breach was reported on 2025-12-22. The breach occurred during 11/11/2025. The breach was discovered on 11/11/2025. 2,722 individuals were affected. Notice was sent on 12/1/2025.

University of Pennsylvania notified NH AG of a security incident involving Oracle E-Business Suite. A previously unknown vulnerability allowed unauthorized access to financial application data. 1,588 NH residents affected; data included names, addresses, SSNs, and banking info. Notification began Dec 1, 2025, offering 24 months credit monitoring. No evidence of misuse. Law enforcement notified.

The University of Pennsylvania based in Philadelphia, Pennsylvania, a educational institution entity reported a data breach to the Texas Attorney General. The breach was discovered on 2025-11-11 and reported on 2025-12-03. 11,455 Texas residents were affected. 442,500 individuals affected in total. Types of information involved: Name of individual;Address;Social Security Number Information;Financial Information (e.g. account number, credit or debit card number). Consumers were notified via U.S. Mail.

The University of Pennsylvania notified California residents of a data breach involving a third-party Oracle E-Business Suite application. A previously unknown vulnerability (zero-day) in Oracle software allowed unauthorized access to data between August 9 and August 11, 2025. Affected data included Social Security numbers, names, addresses, and bank account information. The University engaged cybersecurity experts, notified law enforcement, applied patches, and is offering 24 months of credit monitoring.

University of Pennsylvania reported a data breach to the Montana Attorney General. The breach was reported on 2025-12-01. The breach occurred on 11/11/2025. 465 Montana residents were affected.

University of Pennsylvania, a education sector entity reported a data breach to the Iowa Attorney General. The breach was reported on 2025-12-01.

The University of Pennsylvania notified affected individuals of a data security incident involving its third-party Oracle E-Business Suite (EBS) application. The incident involved a previously unknown security vulnerability (zero-day/n-day) exploited by an external actor to gain unauthorized access and exfiltrate personal information, including government-issued identifiers and basic PII. Penn discovered the unauthorized access on November 11, 2025, and notified law enforcement. No evidence of misuse was found at the time of notification. Remediation included applying Oracle security patches, reinforcing systems, and offering 24 months of complimentary credit monitoring via Experian.

The University of Pennsylvania reported a data breach impacting 1,488 Maine residents. The incident was identified as an external system breach or hacking event that occurred from August 9 to August 11, 2025. The breach was discovered on November 11, 2025. In response, the university is offering 24 months of complimentary credit monitoring and remediation services through Experian.

The University of Pennsylvania reported a data breach to the Indiana Attorney General. The breach occurred on 2025-08-09 and was reported on 2025-12-01. 2,067 Indiana residents were affected.

The University of Pennsylvania, a education sector entity reported a unauthorized access incident to the Washington Attorney General. The organization became aware of the incident on 2025-09-29 and filed notice on 2025-12-01. 6,413 Washington residents were affected. 63 days elapsed between awareness and notification. 51 days to identify the breach. 0 days to contain the breach.

The University of Pennsylvania notified consumers of a data security incident involving its third-party Oracle E-Business Suite application. A previously unknown security vulnerability allowed unauthorized access to data. The incident involved personal information including names and Social Security numbers. Penn engaged cybersecurity experts, notified law enforcement, applied security patches, and offered 24 months of complimentary credit monitoring.

University of Pennsylvania reported a third-party vendor breach on 10/29/2023, discovered 03/22/2024, affecting 388 individuals (1 in Maine). Compromised data included names and Social Security Numbers. The university notified affected individuals in writing on 04/09/2024 and provided 24 months of credit monitoring via Experian.

University of Pennsylvania reported a data breach to the Indiana Attorney General. The breach occurred on 2023-10-29 and was reported on 2024-04-09. 3 Indiana residents were affected. 388 individuals affected in total.

University of Pennsylvania reported a data breach to the Montana Attorney General. The breach was reported on 2023-03-01. The breach occurred from 8/13/2022 to 10/24/2022. 1 Montana residents were affected.