EXPLORINEER
en

Archive — US — techcrunch

University of Pennsylvania confirms hacker stole data during cyberattack

The University of Pennsylvania confirmed a cyberattack that resulted in the theft of sensitive data, including donor documents and personal information, following phishing attempts targeting alumni. The breach was attributed to social engineering tactics, and while the university acted quickly to contain it, concerns were raised regarding multi-factor authentication exemptions for some staff.

Key points

  • On October 31, the University of Pennsylvania identified a data breach affecting its development and alumni information systems.
  • Hackers sent emails from official Penn addresses, claiming to have stolen data and demanding financial support cessation.
  • The breach stemmed from a social engineering attack where individuals were tricked into revealing login credentials.
  • Some high-ranking university officials bypassed multi-factor authentication (MFA), raising security concerns.
  • Penn will notify individuals whose data was accessed, but specifics on the extent and affected parties are still unclear.
  • The hacker's motivations included financial gain and criticism of affirmative action practices, paralleling a similar breach at Columbia University.

Why it matters

  • This incident reflects a growing trend of cyberattacks on educational institutions, highlighting vulnerabilities in security practices.
  • The use of social engineering tactics has increased in recent years, correlating with more sophisticated phishing schemes targeting organizations.
  • Concerns regarding data privacy and security have surged as higher education institutions face scrutiny over their data protection measures.
  • The incident is part of a larger pattern where cybercriminals exploit socio-political tensions, as seen in other university breaches earlier this year.

The University of Pennsylvania's data breach underscores the pressing need for robust cybersecurity measures and the vigilance required in safeguarding personal information in educational institutions, especially amidst rising cyber threats.