On October 30, 2025, the University of Pennsylvania suffered a data breach that ultimately exposed records of 624,000 unique email addresses, names, and physical addresses belonging to its donors. The attackers followed the breach with a ransom demand, later publishing the stolen data online in February 2026. For many records the exposed information also included dates of birth, genders, job titles, and salutations. A smaller subset contained religions, spouses’ names, estimated income levels, and charitable donation histories.
Named in this incident?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Not ready yet? Run a free breach check on this email
We’ll check it against 13.1B+ leaked records right now — no account needed. Continuous monitoring & alerts are part of Protection.
What Public Reporting Shows
Public reporting indicates the breach primarily targeted the university’s donor database. The incident came to light after the attackers sent inflammatory emails to some of the affected individuals. The full dataset appeared on a leak site in February 2026, roughly four months after the initial breach date of October 30, 2025. Industry research from sources such as DoxxScan™ continuous monitoring confirms that 624K unique email addresses were exposed along with names and home addresses. Additional fields such as date of birth, gender, job title, and religion appeared in varying portions of the dataset, with donation histories limited to a small subset of records.
Why This Matters for You and Your Family
When your name, physical address, email, date of birth, and donation patterns sit together in one leaked file, the information becomes far more useful to identity thieves and harassers than any single piece on its own. You and your family can face sudden junk mail, targeted scams pretending to be from the university, or worse—personal attacks that reference your giving history or religious affiliation. Children in the household may also be affected if a parent’s record links to family addresses or shared email accounts used for school and extracurricular activities. Once data like this escapes, it rarely disappears; copies circulate for years on underground forums.
The Doxxing and Identity-Chain Implications
Attackers do not stop at the initial leak. They combine the University of Pennsylvania data with other publicly available records to build detailed profiles. A home address plus a child’s gaming username can quickly lead to doxxing attempts on Discord, Roblox, or Steam. Credential leaks of this nature often cascade: an email and password pair reused from an old donation portal can hand over access to your bank, health portal, or social media. Public reporting describes these identity-chain attacks as a growing risk precisely because one breach supplies the missing links that tie your online handles to your real-world identity and family members.