Breach Database / University of Pennsylvania
Yes — University of Pennsylvania was breached.
- 623,750 accounts affected
- Breach occurred 2025-10-30 · upenn.edu
- Verified entry in the Have I Been Pwned catalog
What happened
In October 2025, the University of Pennsylvania was the victim of a data breach followed by a ransom demand, largely affecting its donor database. After the incident, the attackers sent inflammatory emails to some victims. The data was later published online in February 2026 and included 624k unique email addresses alongside names and physical addresses. For some donor records, additional personal information was exposed, including gender and date of birth. A small subset of records also contained religion, spouse name, estimated income and donation history.
What data was exposed
- Charitable donations
- Dates of birth
- Email addresses
- Genders
- Income levels
- Job titles
- Names
- Physical addresses
- Religions
- Salutations
- Spouses names
What to do right now
- Watch for targeted phishing mail. A leaked home address makes postal and doorstep scams more convincing.
- Expect convincing phishing emails. Attackers use breached details to write personalized emails. Be suspicious of any message referencing this service.
- Check your other accounts on Have I Been Pwned. Your email address may appear in other breaches you don't know about yet.
- Monitor the apps you use going forward. Clearly watches the breach record for the companies behind your apps and alerts you the moment one appears.
Breach data from Have I Been Pwned. Listing here means the service appears in the public breach record — not that your personal data was affected.