University of Pennsylvania

Summary

A data breach exposed sensitive information of University of Pennsylvania donors, with those claiming responsibility releasing thousands of files including memos about donors, encompassing details about their contributions and personal information. The incident occurred shortly before a similar breach affected Princeton University's donor database, highlighting a broader trend of hackers targeting nonprofit organizations for the valuable donor data they maintain. The breach threatened to damage fundraising efforts by undermining donor trust, as surveys indicate that significant portions of donors would cease or pause giving following such incidents, with reputational impacts potentially lasting for years.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In October 2025, the University of Pennsylvania experienced a data breach in which attackers released thousands of files, including internal memos that contained information about donors. The breach placed donor-related records into the public domain and became part of a broader pattern of cyberattacks targeting nonprofit and educational institutions that maintain large repositories of sensitive donor data. The exposed information reportedly included email addresses, phone numbers, street addresses, and details about donations, placing affected donors at risk of phishing attempts, identity theft, and unwanted solicitations. The release of internal memos also raised concerns about the confidentiality of institutional communications regarding fundraising and donor stewardship.

The breach at the University of Pennsylvania occurred within roughly a month of a similar incident at Princeton University, where a donor database was compromised in November 2025, exposing comparable categories of donor information. This timing drew attention to the increasing frequency of cyberattacks against institutions that hold extensive donor data, including large nonprofits such as Catholic Charities of Southern Nevada and the Salvation Army, which had also reported data losses. The incidents underscored how threat actors recognize the value of nonprofit and university donor records, which can include personally identifiable information alongside financial giving histories. The University of Pennsylvania breach, in particular, was significant because of the volume of files released and the inclusion of internal memos that potentially revealed donor cultivation strategies and institutional decision-making.

The breach at the University of Pennsylvania had immediate implications for donor trust and institutional reputation. Surveys referenced in reporting on the incidents indicate that 28 percent of donors said they would not donate to a nonprofit again if their data had been stolen, while 52 percent said they would withhold donations until satisfied that the issue had been resolved. Research on data breaches in the corporate sector suggests that organizations can experience reputational harm lasting up to four years following such an event, with affected companies performing worse than peers that had not been breached over that period. For the University of Pennsylvania, the exposure of donor memos introduced an additional layer of reputational risk beyond the loss of personal data, as it suggested potential weaknesses in internal document handling and information security controls.

In response to the breach, the University of Pennsylvania faced the challenge of meeting regulatory obligations across multiple jurisdictions, as 20 states have consumer data privacy laws that dictate breach notification and remediation steps. The institution was required to follow the regulations of each state in which affected donors resided, complicating the coordination of its response. Beyond legal compliance, the breach necessitated transparent communication with donors, including acknowledging the incident, clarifying what information was exposed, and outlining the steps being taken to address the situation. The release of internal memos added complexity to this communication, as the institution had to address not only the exposure of personal data but also the unauthorized disclosure of internal documents that could affect donor relationships and fundraising strategy.

The broader impact of the University of Pennsylvania breach contributed to heightened awareness within the nonprofit and higher education sectors about the vulnerabilities of donor databases and internal communications. Cybersecurity experts and fundraising professionals cited in coverage of the incidents emphasized the importance of transparency, targeted messaging to affected stakeholders, and ongoing updates to rebuild trust over time. The inclusion of donor memos among the released files highlighted the need for institutions to assess not only the security of their external-facing systems but also the protection of internal documents that may contain sensitive information about donors and fundraising operations. The breach served as a notable example of the evolving threat landscape facing organizations that rely on the trust of their supporters, and it occurred alongside the Princeton University breach, reinforcing concerns about the targeting of donor data by malicious actors.

Sources

Sources available to members: 1 source.