University of Pennsylvania Data Breach

What happened?

In October 2025, the University of Pennsylvania was the victim of a data breach followed by a ransom demand , largely affecting its donor database. After the incident, the attackers sent inflammatory emails to some victims. The data was later published online in February 2026 and included 624k unique email addresses alongside names and physical addresses. For some donor records, additional personal information was exposed, including gender and date of birth. A small subset of records also contained religion, spouse name, estimated income and donation history.

When did it happen?

The breach date in the public record is October 30, 2025. The record was added to the catalogue on February 16, 2026 and last updated there on February 16, 2026.

What information was reported as exposed?

• Charitable donations
• Dates of birth
• Email addresses
• Genders
• Income levels
• Job titles
• Names
• Physical addresses
• Religions
• Salutations
• Spouses names

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with University of Pennsylvania or used upenn.edu around October 30, 2025. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.