Where does the University of Pennsylvania case file come from?

Every entry is taken from the breach report University of Pennsylvania lodged with the Oregon Attorney General. Nothing here is estimated.

Why do the incident date and the report date differ?

Companies usually investigate before they report. The gap between the two dates shows how long that took.

What does the records-affected figure count?

It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.

Does this case file change over time?

Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Case file

Case File: University of Pennsylvania Data Breach

This file collects the dated facts on record for the University of Pennsylvania incident. The state report is dated December 22, 2025. The incident itself is dated November 11, 2025.

Timeline

41 days separate the incident date from the date it was reported.

November 11, 2025Incident dateWhen the filing says the breach took place.
December 22, 2025Report filed in OregonDate the notice was lodged with the Oregon Attorney General.

Case facts

Filing state: Oregon
Date reported: December 22, 2025
Incident date: November 11, 2025
Receiving office: Oregon Attorney General

Case notes

The University of Pennsylvania has publicly reported a data breach impacting personal information, according to records filed with Oregon state regulators on December 22, 2025. The incident concerns an unauthorized access event where certain personal information was potentially exposed.

The breach date is listed as November 11, 2025, approximately six weeks prior to the filing. At the time of the report, the university indicated that an investigation into the scope and nature of the incident was still underway, meaning full details were not yet confirmed.

Specific details regarding the types of personal information involved in this breach, as well as the exact number of individuals potentially affected, have not been publicly disclosed in the filing. This information is drawn from public records submitted to state authorities.

Individuals who may be affected by this incident are advised to monitor their accounts and financial statements for any unusual activity. Exercise caution with unsolicited communications, particularly those requesting personal details. Consider reviewing credit reports regularly as a general security measure.

Questions about this case file

Where does the University of Pennsylvania case file come from?: Every entry is taken from the breach report University of Pennsylvania lodged with the Oregon Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?: Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?: It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?: Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Oregon data breaches

Filing source: Oregon Attorney General

Named in the University of Pennsylvania breach?

Attach your notice and a short note. An attorney checks it against this case file at no cost.

Timeline

Case facts

Case notes

Questions about this case file

More Oregon case files