Penn is investigating a cybersecurity breach of its Oracle E-Business Suite servers that compromised the personal information of University-affiliated individuals across multiple states.<\/p>\n
The breach \u2014 identified by the University in November \u2014 exploited the business software Penn uses to manage internal operations, according to letters filed with attorneys general in multiple states. Penn is in the process of notifying individuals whose personal information was compromised by the incident, according to a University spokesperson.<\/p>\n
\u201cThe University of Pennsylvania was one of nearly 100-already identified organizations simultaneously impacted by the widely exploited Oracle E-Business Suite incident, involving a previously unknown security vulnerability in Oracle\u2019s system,\u201d the spokesperson wrote in a statement to The Daily Pennsylvanian.<\/p>\n
Penn has implemented \u201cthe patches that Oracle issued to resolve the vulnerability\u201d and \u201chas found no evidence that any of this information has been or is likely to be publicly disclosed or misused for fraudulent purposes,\u201d the statement added.\u00a0<\/p>\n
In a Dec. 1 letter<\/a> notifying impacted individuals, Penn wrote that its investigation \u2014 assisted by federal law enforcement and cybersecurity experts \u2014 discovered that \u201csome data from Penn\u2019s Oracle EBS had been obtained without authorization.\u201d<\/p>\n It remains unclear how many individuals were affected. According to information<\/a> filed with the Office of the Maine Attorney General, the breach affected 1,488 state residents.<\/p>\n \u201cPenn takes this incident very seriously and sincerely apologizes to everyone affected,\u201d Penn\u2019s letter<\/a> reads. \u201cProtecting our community is of utmost importance, and we are committed to maintaining the privacy and security of your information.\u201d\u00a0<\/p>\n The November breach, first reported<\/a> by BleepingComputer, follows a separate cybersecurity breach of an account affiliated with Penn\u2019s Graduate School of Education that occurred in October. Hackers claiming responsibility for that breach alleged<\/a> that they obtained data from 1.2 million students, alumni, and donors. Penn has said<\/a> that figure is \u201coverstate[d].\u201d<\/p>\n Penn has launched an investigation into the October hack and reported<\/a> the incident to the Federal Bureau of Investigation. Several alumni have filed class action lawsuits<\/a> against the University following the October breach, alleging Penn did not sufficiently protect their personal data.\u00a0<\/p>\n Several other Ivy League institutions have been affected by data breaches in recent months. In late November, donor records from Harvard University<\/a> were accessed, and a similar database at Princeton<\/a> was also compromised.<\/p>\n