Data breach
University of Pennsylvania data breach
In 2026, University of Pennsylvania suffered a data breach affecting 1,152,757 records. Exposed data included email addresses, phone numbers, addresses and 1 other type of data.
Breach date
1.2 million
Records in the breach
4
Types of data exposed
Were you affected by the University of Pennsylvania breach?
Enter your email address to see whether it appears in this breach — or any of the other breaches in Leak Database.
Data exposed in the University of Pennsylvania breach
- Email addresses
- Phone numbers
- Addresses
- Financial
About the breach
The University of Pennsylvania (UPenn) experienced two major cybersecurity incidents spanning late 2025 and May 2026:
1. The Late 2025 / Early 2026 Donor & Alumni Systems Breach
• Detection & Timeline: Detected on October 31, 2025, confirmed in November 2025, with leaked data published online by February 2026.
• Attack Vector: Unauthorized access to development, alumni, Salesforce, SAP, and SharePoint systems via compromised senior staff and Graduate School of Education (@upenn.edu) email accounts and PennKey login credentials.
• Compromised Data: Up to 1.2 million records (including 623.8k+ unique email addresses cataloged by Have I Been Pwned) containing names, physical addresses, dates of birth, genders, religions, spouse names, income levels, job titles, salutations, and charitable donation histories.
• Impact & Aftermath: Attackers sent mass inflammatory or impersonation emails to alumni and donors and demanded a $1 million ransom. The FBI was called, and multiple class-action federal lawsuits (such as Mackey and Lundy) were filed against the university alleging negligence.
2. The May 2026 Instructure Canvas Vendor Breach
• Detection & Timeline: Occurred around May 7, 2026, during final exams.
• Attack Vector: A third-party cyberattack on Instructure, the parent company of the Canvas learning management system, which impacted nearly 9,000 educational institutions nationwide (including UPenn, Rowan, and Rutgers).
• Compromised Data: Affected approximately 306,000 UPenn affiliates. Exposed information included names, email addresses, Penn ID numbers, course enrollments, and internal Canvas messages. Sensitive credentials like Social Security numbers and passwords remained uncompromised.
• Impact & Aftermath: The hack temporarily crashed Canvas during finals, and the threat group ShinyHunters issued a ransom demand with a May 12 deadline, increasing risks of targeted phishing against students.
1. The Late 2025 / Early 2026 Donor & Alumni Systems Breach
• Detection & Timeline: Detected on October 31, 2025, confirmed in November 2025, with leaked data published online by February 2026.
• Attack Vector: Unauthorized access to development, alumni, Salesforce, SAP, and SharePoint systems via compromised senior staff and Graduate School of Education (@upenn.edu) email accounts and PennKey login credentials.
• Compromised Data: Up to 1.2 million records (including 623.8k+ unique email addresses cataloged by Have I Been Pwned) containing names, physical addresses, dates of birth, genders, religions, spouse names, income levels, job titles, salutations, and charitable donation histories.
• Impact & Aftermath: Attackers sent mass inflammatory or impersonation emails to alumni and donors and demanded a $1 million ransom. The FBI was called, and multiple class-action federal lawsuits (such as Mackey and Lundy) were filed against the university alleging negligence.
2. The May 2026 Instructure Canvas Vendor Breach
• Detection & Timeline: Occurred around May 7, 2026, during final exams.
• Attack Vector: A third-party cyberattack on Instructure, the parent company of the Canvas learning management system, which impacted nearly 9,000 educational institutions nationwide (including UPenn, Rowan, and Rutgers).
• Compromised Data: Affected approximately 306,000 UPenn affiliates. Exposed information included names, email addresses, Penn ID numbers, course enrollments, and internal Canvas messages. Sensitive credentials like Social Security numbers and passwords remained uncompromised.
• Impact & Aftermath: The hack temporarily crashed Canvas during finals, and the threat group ShinyHunters issued a ransom demand with a May 12 deadline, increasing risks of targeted phishing against students.
How to protect yourself
In order to start protecting yourself from possible fraud in future, we highly recommend the following steps:
1. Monitor your credit reports for possible suspicious activities. If you cannot do this yourself, we recommend you sign up with online services that does this on your behalf.
1. Be on the lookout for an increase in spam or fraudulent calls. We recommend you make use of mobile apps like True Caller, which can assist you in identifying potential spam or fraudulent calls.
2. Monitor your banking transactions. Ensure that you are receiving notifications of transactions by either SMS, your app or email.
1. Monitor your credit reports for possible suspicious activities. If you cannot do this yourself, we recommend you sign up with online services that does this on your behalf.
1. Be on the lookout for an increase in spam or fraudulent calls. We recommend you make use of mobile apps like True Caller, which can assist you in identifying potential spam or fraudulent calls.
2. Monitor your banking transactions. Ensure that you are receiving notifications of transactions by either SMS, your app or email.
Get told about the next breach
A free Leak Database account emails you when your address appears in a newly added breach.