UPenn Hack Shows Higher Ed’s Cybersecurity Crisis

In July 2025, schools and universities averaged 4,210 weekly cyberattacks. Three months later, the University of Pennsylvania (UPenn) became the latest institution to face the consequences of chronic underinvestment in cybersecurity.

On October 31, an email from the University of Pennsylvania’s Graduate School of Education began circulating. It contained vulgar claims about the university’s hiring and admissions practices and directly criticized the school’s poor cybersecurity. Students and faculty received messages with the subject line “We Got Hacked,” complete with the seal of the UPenn Graduate School of Education. Some individuals saw the email multiple times; others only learned of it when UPenn issued a press statement afterward.

The email condemned UPenn’s admissions policies, claiming they “love legacies, donors, and unqualified affirmative action admits.” It attempted to criticize both woke and elitist attitudes within the institution, an unusual pairing for a single argument. The writer(s) also alleged that UPenn violated federal laws like FERPA, jeopardizing the safety of student, alumni, and faculty data, and warned the community that “all your data will be leaked.”

The day after the email, the attackers dumped thousands of internal documents and said they had access to 1.2 million additional university records. Beyond their posts on LeakForum, an online platform for discussing hacking, little is known about the breach’s source.

In its official cybersecurity incident update, UPenn reported that it employs an expansive security program that was compromised through social engineering, a tactic in which attackers convince individuals to divulge login credentials. The university assures the community that all systems have been fully restored, the FBI has been notified, and it is collaborating with law enforcement.

UPenn’s cybersecurity failure isn’t just embarrassing; it’s incredibly dangerous. Educational institutions hold financial, contact, and medical data, which, if breached, puts university communities at heightened risk for identity theft. In 2023, U.S. universities devoted around 7 percent of their budgets to cybersecurity, slightly below the global average of 8 percent. Large corporations handling similar user data typically allocate more than 13 percent, nearly double what universities invest.

In an increasingly volatile digital landscape, universities must take responsibility for safeguarding community data. Once a breach occurs, the consequences are irreversible. Students and alumni don’t get a second chance at privacy—as soon as their data is out in the world, it becomes vulnerable to malicious parties across the globe.

Universities can’t afford to wait until the next breach to take action. Students, alumni, and faculty deserve institutions that treat their data with the same seriousness as tuition revenue. Until colleges commit to tangible, sustained investment in cybersecurity, incidents like the UPenn attack won’t be anomalies; they’ll be the new normal.