Ivy League Sued After Hacker Threatens to Leak Personal Info of Students
A University of Pennsylvania alum sued his alma mater Monday after a mass email was sent to students, parents, faculty and alumni on Halloween, threatening to leak their personal information.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
The complaint, filed in the U.S. District Court for Eastern Pennsylvania (docket 2:25-cv-06234), alleges the university was negligent and failed to safeguard the personal information of those associated with the school, which led to the breach. Counts of negligence, unjust enrichment and breach of implied contract were filed.
On Oct. 31, “a series of mass emails were sent to students, faculty, alumni, and parents from accounts linked to the Graduate School of Education,” in which “unknown actors,” who had unauthorized remote access to UPenn email accounts, “stated ‘all your data will be leaked,’” the suit said.
According to the complaint, the personally identifiable information (PII) accessed during the breach included Social Security numbers, names and other demographic information like address and ZIP code.
“UPenn breached its duty and betrayed the trust” of those associated with the school “by failing to properly safeguard and protect their personal information,” the suit said.