Hackers Claim 1.2M Records in Shocking UPenn Data Breach

The University of Pennsylvania’s email systems were weaponized against its own community, sparking panic and raising alarming questions about campus cybersecurity.

"We Got Hacked"

In the early hours of October 31, 2025, a wave of offensive and fraudulent emails flooded the inboxes of University of Pennsylvania students, alumni, and staff. The messages, bearing ominous subject lines like “We got hacked (Action Required),"** were sent from what appeared to be legitimate university accounts, including the Graduate School of Education (GSE) and other senior staff addresses.

The emails contained vulgar language, brutally criticizing the university’s admissions policies and security practices. One section read, "We love breaking federal rules like FERPA (all your data will be leaked)" . The closing plea was stark: "Please stop giving us money" , making the attack’s apparent aim to disrupt alumni donations unmistakably clear.

1.2 Million Victims and a Treasure Trove of Data

The initial email spam was just the tip of the iceberg. Within days, a hacker claiming responsibility alleged the theft of a massive database containing information on 1.2 million students, alumni, and donors.

The stolen data is reported to be a goldmine for identity thieves and a nightmare for the university, potentially including :

Donation history to Penn
Estimated donor net worth
Personal demographic details, including names and race

The hackers bragged to cybersecurity outlet BleepingComputer that they had gained access to Penn’s VPN, Salesforce data, Qlik analytics, and SAP business intelligence systems. They claimed the attack wasn’t politically motivated but was a direct assault on Penn’s **"vast, wonderfully wealthy donor database.

Containment and Contradiction

The university’s response has been a mix of urgent damage control and seemingly conflicting statements.

Official Statements: Penn spokespersons have consistently labeled the emails "fraudulent" and "highly offensive," apologizing for the harm caused and assuring the community that their incident response team is actively addressing the situation .
Internal Confusion: An internal communication from Elizabeth Cooper, an IT help desk manager at Penn’s Annenberg School for Communication, revealed that "ASC has not been hacked," suggesting the breach was limited to a mailing list "beyond our control" .
Public Contradiction: Meanwhile, CBS News Philadelphia reported that the university told them "it was not hacked," creating confusion about the true nature of the security incident.

The attack vector was identified as `connect.upenn.edu`, a Penn mailing list platform hosted on Salesforce Marketing Cloud. The hackers claimed that after losing access to a compromised employee account, they still had access to this marketing system, which they used to send emails to approximately 700,000 recipients.

A Rejected White House Compact

This cyberattack did not occur in a vacuum. It comes just weeks after the University of Pennsylvania was among seven schools that publicly rejected the Trump administration’s **"Compact for Academic Excellence in Higher Education.

This compact would have required universities to :

Abolish affirmative action in hiring and admissions.
Discipline departments that punish conservative ideas.
Marginalize transgender and gender non-conforming students.
Cap international undergraduate enrollment.

Penn President J. Larry Jameson rejected the compact, writing that its "one-sided conditions conflict with the viewpoint diversity and freedom of expression" central to universities.

While the hackers claim their motive was financial, the timing has fueled speculation about a potentially politically charged backdrop to the breach.

Are You at Risk?

The university has advised recipients of the fraudulent emails to :

Mark them as phishing/spam.
Avoid clicking on any links or attachments.
Simply delete the message.

As of now, the hackers have stated that the stolen database "has not yet been leaked" but threatened they "may release it in a month or two." The University continues to investigate, leaving 1.2 million individuals awaiting answers about the safety of their personal information.

*This story is still developing.*

Hackers Claim 1.2M Records in Shocking UPenn Data Breach

Related threat feeds

Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade Long Silence

"We Got Hacked"

1.2 Million Victims and a Treasure Trove of Data

Containment and Contradiction

A Rejected White House Compact

Are You at Risk?

148 Malicious npm Packages Used to Build a Browser Based DDoS Botnet

Pakistan Law Enforcement Agencies Targeted in Alleged Multi Group Cyber Espionage Operations