"We have terrible security practices" - University of Pennsylvania hackers say they've stolen over a million records in major cyberattack

A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.

• Attacker accessed University systems via compromised SSO, stealing data on 1.2 million individuals
• Offensive mass email sent post-ejection using retained access to Salesforce Marketing Cloud
• Stolen data includes PII, financials, and demographics; attacker targets wealthy donors, no ransom planned

Cybercriminals have claimed responsibility for the recent cyberattack on the University of Pennsylvania, claiming they stole data on approximately 1.2 million students, alumni, and donors.