Data Breach: Penn Hacker Exposes 1.2 Million Donor Records

University of Pennsylvania Data Breach Exposes 1.2 Million Donors

Last week, a hacker claimed responsibility for a significant data breach at the University of Pennsylvania, revealing that sensitive information on 1.2 million donors and internal documents were compromised.

Alumni and students of the University of Pennsylvania received offensive emails from Penn.edu addresses, alleging that the university had been hacked and data had been stolen.

The hacker criticized the university, stating, “The University of Pennsylvania is a dog**** elitist institution full of woke retards.” The email also mentioned the university’s security practices and admissions processes.

The emails were sent from connect.upenn.edu, a Penn mailing list platform hosted on Salesforce Marketing Cloud. The university initially dismissed the incident as fraudulent, but the hacker claimed to have accessed multiple university systems.

The hacker stated that they gained full access to an employee’s account, allowing them to breach Penn’s VPN, Salesforce data, Qlik analytics platform, SAP business intelligence system, and SharePoint files.

Data including names, dates of birth, addresses, phone numbers, donation history, and demographic details were accessed. Screenshots and data samples were shared to prove the breach.

The hacker revealed that they breached Penn’s systems on October 30th and downloaded data by October 31st. They later sent offensive emails to over 700,000 recipients.

Although the hacker did not extort the university, they published a 1.7-GB archive containing files allegedly taken from Penn’s systems.

University of Pennsylvania stated they are investigating the incident, while donors were advised to be cautious of phishing attempts using their compromised information.

Protecting Penn Donors from Phishing Attempts

With donor data exposed, Penn donors should be vigilant against potential phishing or social engineering attacks.

Attackers may attempt to impersonate the university, solicit fraudulent donations, or access donor credentials for malicious purposes.

Recipients should verify the legitimacy of any donation-related messages directly with Penn before taking any action.

As MCP (Model Context Protocol) becomes the standard for connecting LLMs to tools and data, security teams are implementing best practices to ensure safety.

Download the free cheat sheet outlining 7 best practices for securing new services today.

Download Now