Penn hacker claims to have stolen 1.2 million donor records in data breach
A hacker has claimed responsibility for breaching the University of Pennsylvania’s systems and stealing 1.2 million donor records. The threat actor contacted BleepingComputer, alleging that the incident extended beyond a simple breach, obtaining access to various university systems. They reported gaining full access to an employee’s PennKey SSO account, allowing for entry to Penn’s VPN, Salesforce data, Qlik analytics platform, SAP business intelligence, and SharePoint files.
The stolen data encompasses names, dates of birth, addresses, phone numbers, estimated net worth, donation history, and demographic details including religion, race, and sexual orientation.
Screenshots and data samples were shared with BleepingComputer to verify the claims. The hacker stated that access to the university’s systems was obtained on October 30th, with data downloads completed by October 31st before the compromised employee account was locked.
Even after losing direct access, the hacker utilized Salesforce Marketing Cloud to send an unsolicited email to around 700,000 recipients. They refrained from providing specific details on how the credentials were acquired, implying that it was due to Penn’s security shortcomings.
In a related note, the hacker has released a 1.7-GB archive containing spreadsheets and materials believed to be extracted from Penn’s SharePoint and Box systems.
Read the complete article here!
Note: For more details on upcoming events, please visit Rise Malaysia for the conference scheduled on December 9th and 10th, 2025.