University of Pennsylvania data breach
University of Pennsylvania appears in 11 breach notices filed with Oregon DOJ, New Hampshire DOJ, Texas AG, California AG, Washington AG, Montana DOJ, SC Consumer Affairs, Iowa AG and Maryland AG, most recently reported on December 22, 2025.
Also listed as: The University of Pennsylvania
Breach notices filed with regulators
| Reported | Filed with | Breach date(s) | People affected | Data involved | Source |
|---|---|---|---|---|---|
| Dec 22, 2025 | Oregon DOJ | Nov 11, 2025 | 2,722 Oregon residents | Not listed | Oregon DOJ list ↗ |
| Dec 4, 2025 | New Hampshire DOJ | Not listed | Not listed | Not listed | Notice ↗ |
| Dec 3, 2025 | Texas AG | Aug 9, 2025 – Aug 11, 2025 | 11,455 Texas residents | Name of individualAddressSocial Security Number InformationFinancial Information (e.g. account number, credit or debit card number) | Texas AG list ↗ |
| Dec 1, 2025 | California AG | Aug 9, 2025, Aug 11, 2025 | Not listed | Not listed | California AG list ↗ |
| Dec 1, 2025 | Washington AG | Aug 9, 2025 – Aug 11, 2025 | 6,413 Washington residents | NameSocial Security NumberFinancial & Banking Information | Washington AG list ↗ |
| Dec 1, 2025 | Montana DOJ | Nov 11, 2025 | 465 Montana residents | Not listed | Notice ↗ |
| Dec 1, 2025 | SC Consumer Affairs | Not listed | 2,578 South Carolina residents | Not listed | Notice ↗ |
| Dec 1, 2025 | Iowa AG | Not listed | Not listed | Not listed | Notice ↗ |
| May 24, 2024 | Maryland AG | Not listed | 6 Maryland residents | NameSocial Security number | Notice ↗ |
| Mar 1, 2023 | Montana DOJ | Aug 13, 2022 – Oct 24, 2022 | 1 Montana residents | Not listed | Notice ↗ |
| Mar 1, 2023 | Maryland AG | Not listed | 1 Maryland residents | NameSocial Security numberAddress | Notice ↗ |
Each row is a notice as published by the agency. For state lists, the number affected counts only that state's residents; HHS lists the total reported. SEC rows are Form 8-K Item 1.05 filings, which usually don't give a count. A notice does not mean a settlement exists, and a settlement may cover a different incident than a given notice.
Is there a settlement?
We don't track an open class-action settlement for University of Pennsylvania right now. Settlements usually come months or years after a breach. Get an email when new settlements are announced.
What you can do now
- Read the notice letter if you got one. It says what data was involved and may offer free credit monitoring with an enrollment deadline.
- Consider a free credit freeze at Equifax, Experian and TransUnion, especially if your Social Security number was involved.
- Change reused passwords and turn on two-factor authentication.
- Watch your bank, card and insurance statements for activity you don't recognize.
Get new settlements and deadline reminders
One email a week: newly announced data-breach settlements and claim deadlines that are about to close. Free. Unsubscribe anytime.