Penn and Phoenix Universities Disclose Data Breach After Oracle Hack

The University of Pennsylvania and the University of Phoenix confirmed they were victims in the Oracle E-Business Suite hack campaign. The Penn disclosure said data breach letters are being sent to individuals whose personal information was compromised, with nearly 1,500 of Maine residents affected, though the total number of impacted individuals has not been disclosed.

Phoenix Education Partners, the university’s parent company, filed with the SEC to reveal the intrusion, which was discovered on 21 November, one day after the university was listed on the Cl0p ransomware leak website; the Oracle EBS campaign was identified in early October.

Investigations indicate the attackers accessed information including names, contact details, dates of birth, Social Security numbers, and bank account information; for many victims, huge volumes of data have been publicly released, though no UoPX data appears to have been released. While Harvard was the first to confirm impact, other institutions have also been named as victims, with Cl0p and potential FIN11-affiliated activity linked to the broader attack.