University of Pennsylvania upenn.edu University of Pennsylvania data breach: what happened and what to do
In late October 2025, an attacker used stolen employee credentials to get into University of Pennsylvania systems used for alumni and donor work. Have I Been Pwned counts 623,750 accounts with names, emails, addresses, dates of birth and donation-related details.
View all 13,115 breaches- Breach date
- 30 Oct 2025
- Made public
- 31 Oct 2025
- Affected
- 623,750
- Data exposed
- Charitable donations, Dates of birth, Email addresses, Genders, Income levels, Job titles, Names, Physical addresses, Religions, Salutations, Spouses names
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
The University of Pennsylvania (Penn) confirmed in late 2025 that an unauthorized person had accessed systems used for development and alumni engagement. Have I Been Pwned (HIBP) dates the breach to October 30, 2025 and added it to its database on February 16, 2026.
What happened
Penn said the incident happened on or around October 31, 2025. Reporting says the attacker used social engineering, meaning they impersonated someone to get valid employee credentials, and then reached systems including the university's Salesforce customer database and marketing email tools. Messages were then sent from a Penn email domain that claimed the university had been hacked and that donor and alumni data had been taken.
Penn later said it had completed a review of the incident and notified the people affected under applicable notification laws.
How many people
HIBP's copy of the data holds 623,750 accounts, which is the figure this page uses. The attacker told a news outlet the real number was around 1.2 million people. Penn hasn't published its own count in the sources used here, so treat the larger number as an unconfirmed claim.
What was exposed
HIBP lists these data types:
- Names and salutations
- Email addresses
- Physical addresses
- Dates of birth
- Genders
- Job titles
- Spouses' names
- Income levels
- Charitable donations
- Religions
That is an unusually personal mix. Alumni and donor records show who gives money, how much, and to what. A criminal reading that can tailor a pitch to a specific person.
What criminals can do with it
Donation history and income level help scammers pick targets who can pay. Expect fake fundraising appeals, "pledge reminder" emails, and calls from someone who quotes your gift and your spouse's name to sound legitimate. A date of birth plus a home address is also the starting point for identity theft.
Religion and income are sensitive on their own. Even without a financial loss, having them in a leaked file is a privacy harm, and you can't take them back.
Penn's response
Penn notified affected people and said it had finished its review. Law firms have announced investigations into possible claims. None of the sources used here describe a settlement.
Serus can't remove breach data from a file that's been copied. It does monitor breach databases and the dark web for your details and alert you if they appear, so you can act. The steps below are specific to what was exposed here.
How to check your own exposure
Search your email address on Have I Been Pwned, which is free and doesn't ask for a password. If the University of Pennsylvania is listed, your email is in the file. Check the address you gave to the alumni office or when you donated, which may not be the one you use today.
What to do if you were in it
- 1
Be careful with any message about donations or your Penn account
Attackers sent messages from a Penn domain during the incident, and the data lets scammers write convincing follow-ups. Don't click links. If a request seems real, contact Penn's development office through the number on its official site.
- 2
Expect personalized phishing and phone scams
Scammers may quote your giving history, your spouse's name or your job title. Treat anyone who asks you to confirm details or move money as unverified until you call back on an official number.
- 3
Freeze your credit
Your date of birth and address were exposed. A credit freeze at Equifax, Experian and TransUnion is free and stops new accounts being opened in your name. You can lift it when you need to.
- 4
Review bank and card statements
Look for charges or accounts you don't recognize, and set up transaction alerts with your bank.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures without searching for them.
Frequently asked
Was I affected by the Penn data breach?
Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 623,750 accounts. If Penn contacted you, it has your details on file as affected.
What was exposed?
Names, emails, addresses, dates of birth, genders, job titles, spouses' names, income levels, charitable donations and religions, according to HIBP.
Is there a settlement?
Law firms have announced investigations, but none of the sources used here report a settlement.
Should I change my password?
HIBP doesn't list passwords for this breach, so a change isn't required. If you reuse passwords, it's still a good idea to fix that.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
