Privacy Unpacked
Menu

Confirmed breach · 2 breaches on record

University of Pennsylvania data breach

Country being checked · upenn.edu

A breach of University of Pennsylvania was added to Have I Been Pwned’s breach database on 16 February 2026. It affected 623,750 accounts. Exposed: Email addresses, Dates of birth, Names, Addresses, Charitable donations and Genders and more. The breach began on 30 October 2025, 109 days before it was reported.

Breach reported 16 February 2026

Status
Confirmed breach
People affected
623,750 accounts
Reported
16 February 2026
Breach began
30 October 2025
Time to tell
109 days (the median in California’s notices over the last year: 154 days)

What was exposed

  • Email addresses
  • Dates of birth
  • Names
  • Addresses
  • Charitable donations
  • Genders
  • Income levels
  • Job titles
  • Religions
  • Salutations
  • Spouses names

Sources

Breach databases are read by code. · Corrections and changes

Breach reported 1 December 2025

Status
Confirmed breach
People affected
11,455 Texas residents (one state’s count; the total can be higher)
Reported
1 December 2025
Across the state notices
at least 20,590 people (Oregon, Texas and Washington: each state counts only its own residents)
Breach began
11 November 2025
Time to tell
20 days (the median in California’s notices over the last year: 154 days)

What was exposed

  • Social Security numbers
  • Financial account and card details
  • Names
  • Addresses

What changed since it was first reported

  1. Confirmed breach, 11,455 Texas residents (Texas Attorney General)

Sources

Official notices are read by code from the regulator’s own register. More notices to Oregon, Texas, Iowa, California, Washington. · Corrections and changes

If University of Pennsylvania had your data

  1. Look for University of Pennsylvania’s own notice or letter: it should say what of yours was involved. Keep it.
  2. Expect scams that use your details: calls, texts or emails pretending to be University of Pennsylvania, your bank or the police. Never give codes or passwords, never approve a sign-in you did not start, never move money.

One email to confirm first. We use your address only for this alert, and one click deletes it.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Found a mistake? Tell us and we correct it.