Where does The University of Pennsylvania case file come from?

Every entry is taken from the breach report The University of Pennsylvania lodged with the California Attorney General. Nothing here is estimated.

Why do the incident date and the report date differ?

Companies usually investigate before they report. The gap between the two dates shows how long that took.

What does the records-affected figure count?

It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.

Does this case file change over time?

Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Case file

Case File: The University of Pennsylvania Data Breach

This file collects the dated facts on record for The University of Pennsylvania incident. The state report is dated December 1, 2025. The incident itself is dated August 9, 2025.

Timeline

114 days separate the incident date from the date it was reported.

August 9, 2025Incident dateWhen the filing says the breach took place.
December 1, 2025Report filed in CaliforniaDate the notice was lodged with the California Attorney General.

Case facts

Filing state: California
Date reported: December 1, 2025
Incident date: August 9, 2025
Receiving office: California Attorney General

Case notes

The University of Pennsylvania has publicly reported a data security incident, confirming that personal information may have been compromised as a result of an event on August 9, 2025. The institution filed its official notification on December 1, 2025, detailing the incident to regulators.

While the specific nature of the breach remains unspecified in the public record, the University of Pennsylvania has indicated that it is actively investigating the incident. The full scope of the compromise and the types of personal information involved are part of this ongoing inquiry.

This disclosure is made through public regulatory filings, serving to inform affected individuals and the public about the event. As the investigation continues, further details regarding the incident may emerge, providing a clearer picture of what transpired.

Individuals who believe they may be affected by this data security incident should remain vigilant. It is always a good practice to monitor your financial accounts and credit reports for any suspicious activity and to exercise caution with unsolicited communications that request personal information.

Consider changing passwords for online accounts, especially if you have reused them across multiple services. Reviewing account statements and credit reports regularly can help detect any potential misuse of your data early on, allowing for prompt action.

Questions about this case file

Where does The University of Pennsylvania case file come from?: Every entry is taken from the breach report The University of Pennsylvania lodged with the California Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?: Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?: It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?: Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

California data breaches

Filing source: California Attorney General

Named in The University of Pennsylvania breach?

Attach your notice and a short note. An attorney checks it against this case file at no cost.

Timeline

Case facts

Case notes

Questions about this case file

More California case files