Security Alerts 8 min read

Three Ivy League data breaches in under 3 months

Impact: HIGH User Risk: HIGH

A wave of cyberattacks has struck elite Ivy League universities with three major breaches occurring in rapid succession over the past three months. The University of Pennsylvania became the latest victim in December 2025 after hackers exploited an Oracle vulnerability, exposing data on nearly 1,500 individuals. This follows similar attacks on Princeton University in November (affecting over 100,000 people through phone phishing) and Dartmouth College in August (compromising 40,000+ records via the Cl0p ransomware gang). These incidents highlight the alarming vulnerability of prestigious educational institutions, which attract hackers due to their wealthy donor databases, valuable research assets, and high-profile status. The breaches exposed sensitive information including Social Security numbers, financial data, and personal records of students, alumni, donors, and staff members.

Index:

University of Pennsylvania: The Latest Oracle Victim
Princeton University: Phone Phishing Exposes Donor Database
Dartmouth College: Cl0p Ransomware Gang Strikes
Why Ivy League Schools Are Prime Targets
How Hackers Breached Elite Universities
What You Should Do If You’re Affected

University of Pennsylvania: The Latest Oracle Victim

The University of Pennsylvania disclosed in early December 2025 that it had suffered a significant data breach affecting its Oracle E-Business Suite (EBS) system. The attack, which occurred in October 2025, compromised sensitive information from systems used to “process supplier payments, reimbursements, general ledger entries, and to conduct other University business,” according to UPenn’s official data breach notification.

According to information submitted to the Maine Attorney General’s Office, nearly 1,500 Maine residents had their details exposed. This suggests the total scope of the breach extends far beyond this figure when accounting for victims nationwide. UPenn confirmed it was “one of nearly 100 already-identified organizations simultaneously impacted by the widely exploited Oracle E-Business Suite incident, involving a previously unknown security vulnerability in Oracle’s system.”

The university has been notably absent from the Cl0p ransomware gang’s dark web leak site, raising questions about whether ransom demands were met or if the attackers deemed the data less valuable. UPenn is offering affected individuals up to two years of complimentary credit monitoring and identity theft protection services, indicating that personally identifiable information (PII) was likely compromised.

This wasn’t UPenn’s first security incident in recent months. Just days before Halloween 2025, the university experienced another breach when mass emails criticizing university practices were sent using a senior systems administrator’s compromised account, affecting current and former students, faculty, and parents.

Princeton University: Phone Phishing Exposes Donor Database

Princeton University fell victim to a sophisticated phone phishing attack on November 10, 2025, which compromised its University Advancement database containing sensitive information about alumni, donors, faculty, students, parents, and other individuals connected to the institution.

The breach stemmed from what cybersecurity experts call “vishing” (voice phishing), where attackers used phone-based social engineering tactics to trick a university employee with routine access to the advancement database into providing their credentials. The attacker began their operation midday on November 10, and Princeton’s security team contained the incident within 24 hours.

Despite the quick response, the damage was significant. According to reports, at least 100,000 individuals may have been affected by the breach. The compromised database is particularly valuable because it contains detailed records of Princeton’s wealthiest donors and distinguished alumni—information that can be exploited for future targeted scams.

A class-action lawsuit filed on November 25, 2025, alleges that Princeton failed to implement adequate safeguards to protect this sensitive information. The lawsuit claims the university collected and stored highly sensitive data but didn’t follow basic industry security standards.

Dartmouth College: Cl0p Ransomware Gang Strikes

Dartmouth College confirmed in late November 2025 that it had been breached by the notorious Cl0p ransomware gang between August 9 and August 12, 2025. The attackers exploited a zero-day vulnerability in Oracle’s E-Business Suite (CVE-2025-61882, with a critical CVSS score of 9.8) to gain unauthorized access to Dartmouth’s systems.

According to Forbes reporting, more than 40,000 people had their personal information compromised in the attack, including highly sensitive data such as Social Security numbers. The breach notification filed in Maine indicated at least 35,000 individuals in that state alone were affected.

The Cl0p ransomware gang has been on an aggressive hacking spree throughout 2025, systematically exploiting the Oracle EBS vulnerability across dozens of organizations. The group typically lists victims on their dark web forum and demands ransom payments in exchange for not releasing stolen data publicly. Oracle itself was even listed among Cl0p’s victims, demonstrating the widespread nature of this campaign.

Dartmouth has offered affected individuals two years of complimentary credit monitoring and identity theft protection services. The college implemented patches provided by Oracle to resolve the vulnerability, but the damage from the three-day intrusion had already been done.

Why Ivy League Schools Are Prime Targets

Cybersecurity experts point to several factors that make prestigious universities particularly attractive to hackers:

Wealthy Donor Databases: Ivy League schools maintain extensive databases of affluent alumni and donors. As Doug Thompson, chief education architect at Tanium cybersecurity firm, explained: “If I’m going to break into a bank, I’m breaking into the biggest one I can find. They’re ripe for it because they’re so big and have so much money.”

Valuable Research Assets: Elite universities conduct cutting-edge research in military technology, pharmaceuticals, and advanced manufacturing. Foreign state-sponsored hackers target these institutions to steal research data and intellectual property worth millions or billions of dollars.

Political Motivations: In the current political climate, Ivy League institutions have become symbols of elite academia and targets for “hacktivists” opposed to their policies. The hacker who breached UPenn sent a crude mass email attacking the university’s admissions practices, demonstrating how political grievances fuel some cyberattacks.

Large Attack Surface: Universities must grant network access to thousands of students, faculty, staff, and researchers—many with limited cybersecurity awareness. As Brent Riley of Cyxcel security firm noted, “Education is such an easy target for threat actors, mostly because of the necessity for so many unsophisticated users to be on the network.”

Inadequate Security Investment: Despite their wealth, many universities have historically underfunded their IT security infrastructure relative to the value of their data assets and the sophistication of threats they face.

How Hackers Breached Elite Universities

The three recent Ivy League breaches utilized different attack vectors, demonstrating the varied tactics cybercriminals employ:

Social Engineering Attacks:

Princeton and Harvard fell victim to phone phishing (vishing) attacks where hackers manipulated employees into revealing credentials
These attacks exploit human psychology rather than technical vulnerabilities
Generative AI has made phishing attempts more sophisticated and harder to detect, as grammatical errors and spelling mistakes—traditional red flags—are now largely eliminated

Software Vulnerabilities:

UPenn and Dartmouth were compromised through a critical Oracle E-Business Suite vulnerability
The Cl0p ransomware gang discovered and exploited this zero-day flaw before Oracle could patch it
Nearly 100 organizations worldwide were affected by this single vulnerability

Credential Theft:

Attackers gained access to legitimate employee accounts with authorized database access
Once inside, hackers could navigate systems undetected while appearing as legitimate users
Multi-factor authentication can be bypassed when employees are socially engineered into providing access codes

Riley emphasized that “the best security defense in the world can’t get around the human element being vulnerable to making mistakes, keeping data somewhere where it shouldn’t be, allowing a threat actor to steal their password and getting tricked into providing multifactor identification.”

What You Should Do If You’re Affected

If you’re a student, alumnus, donor, faculty member, or staff member at an affected institution, take these immediate steps to protect yourself:

Monitor Your Accounts:

Check bank accounts, credit cards, and financial statements regularly for unauthorized transactions
Set up account alerts for unusual activity
Review your credit reports from all three major bureaus (Equifax, Experian, TransUnion)

Enroll in Credit Monitoring:

Take advantage of the free credit monitoring services offered by the affected universities
These typically include identity theft protection and fraud assistance
Set up credit freezes at Equifax, Experian, and TransUnion to prevent unauthorized credit applications

Watch for Targeted Scams:

Be especially vigilant about phishing emails, calls, or texts claiming to be from your university
Hackers now have detailed personal information they can use to make scams more convincing
Never provide sensitive information in response to unsolicited communications
Verify requests by contacting the institution directly through official channels

Strengthen Your Security:

Change passwords for any accounts associated with the university
Enable multi-factor authentication wherever possible
Use unique, complex passwords for each account (consider a password manager)
Be skeptical of phone calls requesting credentials or personal information

Consider a Fraud Alert:

Place a fraud alert on your credit file by contacting one of the three credit bureaus
This requires creditors to verify your identity before extending credit
Initial fraud alerts last one year and can be renewed

Report Suspicious Activity:

Contact the Federal Trade Commission if you become a victim of identity theft
File a report with local law enforcement if you experience fraud
Notify your bank and credit card companies immediately of any fraudulent charges

Stay Informed:

Monitor communications from your university about the breach
Check if you’re eligible for legal action through class-action lawsuits
Keep records of all breach-related correspondence and expenses

The recent wave of Ivy League breaches serves as a stark reminder that no institution—regardless of prestige or resources—is immune to cyberattacks. As hackers become more sophisticated and universities hold increasingly valuable data, the threat landscape will only intensify. Individuals connected to these institutions must remain vigilant and proactive in protecting their personal information.