University of Pennsylvania data breach: 623K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-02-16
In October 2025, the University of Pennsylvania was the victim of a data breach followed by a ransom demand, largely affecting its donor database. After the incident, the attackers sent inflammatory emails to some victims. The data was later published online in February 2026 and included 624k unique email addresses alongside names and physical addresses. For some donor records, additional personal information was exposed, including gender and date of birth. A small subset of records also contained religion, spouse name, estimated income and donation history. Exposed data: charitable donations, dates of birth, email addresses, genders, income levels, job titles, names, physical addresses, religions, salutations, spouses names. The breach dates from Oct 30, 2025; Have I Been Pwned loaded it on Feb 16, 2026.
What to do
- If you had a University of Pennsylvania account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
