In 2025, the University of Pennsylvania experienced a data breach involving its Oracle E-Business Suite environment. The university publicly disclosed the incident and filed a breach notification letter with the Maine Attorney General, also sending notifications to impacted individuals around December 2, 2025. Penn stated it had patched the vulnerability and found no evidence the information was publicly disclosed or misused for fraud.
The incident involved personal information taken from Penn’s Oracle EBS instance, though a complete itemized list of exposed data elements has not been publicly specified. At least 1,488 Maine residents were identified as affected, but the total number of impacted individuals worldwide remains undisclosed. The university’s medical records systems were reportedly not affected.
Details regarding the full scope of the breach, including the specific types of personal information affected for all individuals, may emerge later. Breach notices may also be delayed for some affected parties.