Several former students are suing the University of Pennsylvania, claiming that the school didn’t take sufficient measures to protect their personal information.
The lawsuits follow the FBI’s investigation into a cybersecurity breach at the university. Penn discovered the problem when a crude email was sent from the Graduate School of Education.
The institution put out a statement on Tuesday, November 4, saying in part:
“On October 31, Penn discovered that a select group of information systems related to Penn’s development and alumni activities had been compromised. Penn employs a robust information security program; however, access to these systems occurred due to a sophisticated identity impersonation commonly known as social engineering.
Penn’s staff rapidly locked down the systems and prevented further unauthorized access; however, not before an offensive and fraudulent email was sent to our community and information was taken by the attacker. Penn is still investigating the nature of the information that was obtained during this time.
It is important to note that all systems have been restored and are fully operational.
We recognize the severity of this incident and are working diligently to address it. Since the incident, Penn’s information security teams have been working around the clock. Penn has notified the FBI and continues to work with law enforcement. We are investigating the incident with the assistance of third-party cybersecurity professionals, including CrowdStrike, an industry leader in cybersecurity.”
According to NBC10’s news gathering partner, KYW Newsradio, three alumni have filed separate suits in federal court.
The alumni claim that hackers had stolen their personal information from donor records.
NBC10 reached out to Penn for comment on the lawsuits, but has not received a response.