{"id":25239,"date":"2025-11-05T07:01:07","date_gmt":"2025-11-05T07:01:07","guid":{"rendered":"https:\/\/www.newsbeep.com\/us-pa\/25239\/"},"modified":"2025-11-05T07:01:07","modified_gmt":"2025-11-05T07:01:07","slug":"penn-says-data-breach-is-contained","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us-pa\/25239\/","title":{"rendered":"Penn says data breach is ‘contained’"},"content":{"rendered":"

The University of Pennsylvania<\/a> said Tuesday it is confident that a data breach attack<\/a> in which hackers allege they accessed large volumes of personal donor, student, and alumni information has been \u201ccontained\u201d and the school has hired cybersecurity professionals to help investigate.<\/p>\n

While it\u2019s been reported that hackers allege accessing data on 1.2 million students<\/a>, donors, and alumni, Penn said it could not confirm that number and is still investigating the material that was accessed. <\/p>\n

\u201cHowever, we do know that the stolen credentials were used to access systems related to Penn\u2019s development and alumni activities,\u201d the university said <\/a>on an information page about the incident posted Tuesday evening.<\/p>\n

Systems accessed include \u201cPenn\u2019s Customer Relationship Management (CRM) system (Salesforce), file repositories (SharePoint and Box), a reporting application (Qlikview), as well as Marketing Cloud,\u201d the school said.<\/p>\n

Penn Medicine\u2019s electronic medical records do not appear to have been accessed, the school said.<\/p>\n

The breach occurred as a result of \u201ca sophisticated identity impersonation commonly known as social engineering,\u201d the university said. That\u2019s when \u201cbad actors deceive individuals into giving up confidential information which compromises security and can be used to access private systems and information.\u201d<\/p>\n

Penn said it was taking steps to prevent future attacks and would be instituting mandatory training.<\/p>\n

Penn intends to notify people whose data may have been comprised \u201cif and when appropriate and as required by applicable notification laws,\u201d the school said.<\/p>\n

The data breach reportedly included thousands of pages of information, in some cases dating back decades, and including internal university memos, bank records, and donor, student, and alumni information.<\/p>\n

The data released, according to The Daily Pennsylvanian<\/a>, Penn\u2019s student newspaper, included memos about donors and their families, receipts of bank transactions, and personal information. The DP said it reviewed the documents released by the alleged hacker on LeakForum, and that the group claimed to have accessed data on 1.2 million Penn students, alumni, and donors.<\/p>\n

The Verge, a technology publication, reported that<\/a> among the items released is personal information about former President Joe Biden<\/a>, whose granddaughter had been a student at Penn, and talking points used to prepare former Penn President Liz Magill for her congressional testimony in 2023, according to the New York Times<\/a>. Magill resigned after a bipartisan backlash to her testimony on the school\u2019s handling of antisemitism complaints.<\/p>\n

The hacker told the Verge they plan to sell some of the data before releasing it publicly.<\/p>\n

Some of the data seem to be focused on Penn\u2019s admissions. The hackers alleged that Penn \u201clove[s] legacies, donors, and unqualified affirmative action admits,\u201d according to the Daily Pennsylvanian.<\/p>\n

\u00bb READ MORE: Penn is investigating a \u2018fraudulent\u2019 email breach<\/a><\/p>\n

The incident first came to light Friday after some students and alumni received what the school called a \u201cfraudulent\u201d<\/a> email that crudely criticized the school\u2019s hiring practices and encouraged people to stop giving money. The email was crafted to appear as if it came from Penn\u2019s Graduate School of Education.<\/p>\n

\u201cWe have terrible security practices and are completely unmeritocratic,\u201d the email said.<\/p>\n

The university said on Friday that information security workers were \u201cactively addressing\u201d the situation and the school reported<\/a> the breach to the FBI. <\/p>\n

\u201cWe are working with law enforcement as well as other third-party technical resources to address this as rapidly as possible,\u201d the school said.<\/p>\n

\u00bb READ MORE: Penn reports email breach incident to the FBI, and an alum files a lawsuit<\/a><\/p>\n

On Sunday, cybersecurity news website Bleeping Computer<\/a> reported that a hacker, who remained anonymous, claimed credit for the email and said they had taken data for a large number of people affiliated with the university. <\/p>\n

A proposed class action lawsuit filed Monday in U.S. Eastern District Court alleges that Penn failed to protect users\u2019 sensitive data and in turn allowed it to fall into \u201cthe hands of cybercriminals who will undoubtedly use [the information] for nefarious purposes.\u201d<\/p>\n

Filed on behalf of Christopher Kelly, a Penn alumnus in Chicago, the lawsuit claims that there are more than 100 potential class members. Penn, the lawsuit alleges, was negligent in enforcing its security policies and failed to quickly notify those impacted, among other claims.<\/p>\n

A Penn spokesperson has declined to comment on the lawsuit.<\/p>\n

In Tuesday\u2019s message, Penn warned its community \u201cto be wary of suspicious calls or emails that could be phishing attempts, particularly those that may be soliciting fraudulent donations, asking for your system credentials, or suggesting you change credentials or passwords. Also be wary of any embedded links in emails that you are not familiar with.\u201d <\/p>\n

Staff writer Nick Vadala contributed to this article. <\/p>\n","protected":false},"excerpt":{"rendered":"The University of Pennsylvania said Tuesday it is confident that a data breach attack in which hackers allege…\n","protected":false},"author":2,"featured_media":25240,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[69,71,70,16684],"class_list":["post-25239","post","type-post","status-publish","format-standard","has-post-thumbnail","category-philadelphia","tag-philadelphia","tag-philadelphia-headlines","tag-philadelphia-news","tag-upenn-data-breach-hack-email"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us-pa\/wp-json\/wp\/v2\/posts\/25239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us-pa\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us-pa\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-pa\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-pa\/wp-json\/wp\/v2\/comments?post=25239"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us-pa\/wp-json\/wp\/v2\/posts\/25239\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-pa\/wp-json\/wp\/v2\/media\/25240"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us-pa\/wp-json\/wp\/v2\/media?parent=25239"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-pa\/wp-json\/wp\/v2\/categories?post=25239"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-pa\/wp-json\/wp\/v2\/tags?post=25239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}