University of Pennsylvania and University of Phoenix disclose data breaches

The University of Pennsylvania and the University of Phoenix confirmed they were hit in the Oracle E-Business Suite cyberattack campaign, which targeted Oracle EBS users including academic institutions. Penn said it used Oracle EBS for supplier payments, reimbursements, and ledger entries, and that data from its EBS environment had been accessed without authorisation during the investigation launched after Oracle flagged the flaw.

On 11 November 2025, Penn concluded that the recipient’s personal data was among the information taken, and the university is notifying affected individuals while not disclosing the total number affected. The data breach notification shared with the Maine Attorney General states that the impacted information included personal data, and Penn is offering 24 months of complimentary Experian credit monitoring and remediation services.

The University of Phoenix disclosed a breach through Phoenix Education Partners, with a Form 8-K filed indicating that an unknown vulnerability in Oracle EBS was exploited by an unauthorised third party to exfiltrate data, and that the incident did not impact business operations; investigators believe the vulnerability was used in August 2025 to copy data from the Oracle EBS environment, with personal information such as names, contact details, dates of birth, SSNs, and bank account details affected.