UPenn Data Breach Lawsuit: From the Halloween Email to a Texas Courtroom
Active Litigation
The “halloween email scare exposes UPenn data breach lawsuit” story starts on October 31, 2025, when mass emails from Penn-affiliated addresses told students and alumni the university had been hacked. Hackers claimed 1.2 million records. Penn later said fewer than 10 people had personal information exposed in that incident. A second, larger Penn breach came through Oracle software. In April 2026 the combined lawsuit moved to federal court in Texas. As of October 17, 2026 there is no Penn settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened and What the Lawsuit Says
On Friday, October 31, 2025, students and alumni received what Penn called a “fraudulent” email, made to look like it came from the Graduate School of Education. Penn reported the incident to the FBI and said stolen credentials had been used to reach “systems related to Penn's development and alumni activities.” The attackers claimed data on 1.2 million students, donors and alumni; Penn said it could not confirm that number. On November 1, 2025 the people claiming the hack released thousands of pages of internal files, including donor memos and bank receipts.
The first class action followed within days. It alleges that “cybercriminals easily infiltrated Defendant's inadequately protected email accounts,” pleads negligence, and cites Section 5 of the FTC Act. These are allegations; Penn has not conceded them.
A second, separate breach. In December 2025 Penn disclosed that attackers had taken data from its Oracle E-Business Suite system through a previously unknown flaw — part of a campaign that hit nearly 100 organizations. Penn determined on November 11, 2025 that individuals' data was involved and sent letters dated December 1.
Case details
The first suit is Kelly v. University of Pennsylvania, No. 2:25-cv-06234, filed November 3, 2025 in the U.S. District Court for the Eastern District of Pennsylvania and assigned to Judge Mary Kay Costello. On December 18, 2025 she consolidated the related cases under that number; the Inquirer counted 18 lawsuits. Several plaintiffs then withdrew.
According to a Mealey's report of April 10, 2026, the Pennsylvania court granted a joint motion to transfer the consolidated case to Texas, where In re Oracle Corporation Data Breach Litigation, No. 1:25-cv-01805 in the Western District of Texas, already includes claims against Penn's trustees over the Oracle breach.
Status: Active Case in Texas, No Penn Settlement
The case changed shape early. In a February 2, 2026 court filing, plaintiffs' counsel wrote that Penn confirmed the October 31 breach “impacted less than 10 people” and that none of the plaintiffs were among them. The same filing said the Oracle breach affected “hundreds of thousands of people.” The litigation now centers on the Oracle incident.
One open point: the Texas docket shows a notice of settlement and a stay entered on October 15, 2026. The entries do not say which defendant they cover, and that case has many defendants. Treat it as unconfirmed for Penn until an official notice names Penn.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Could Be Affected
October 31 incident: Penn says it finished its review and notified the “limited number of individuals” whose personal information was involved — fewer than 10 people. No filing with a state attorney general reporting a larger count has surfaced. If you got only the offensive email, that alone did not mean your records were taken.
Oracle incident: Penn's notice filed with the Maine Attorney General lists 1,488 people; reports differ on whether that is Maine residents only, and Penn has not published a national total. If you received a Penn letter dated around December 1, 2025 about Oracle E-Business Suite, keep it — it is the best proof you belong to any future class.
Leaked donor data: Have I Been Pwned lists a Penn dataset published in February 2026 with about 624,000 email addresses, mostly from the donor database. Penn has not confirmed that figure.
Is There Money?
For context only: in the same Texas case, Dartmouth College agreed to a $750,000 settlement covering more than 96,000 people — $75 in cash or up to $5,000 for documented losses, plus two years of credit monitoring. Its claim deadline was October 21, 2026, and a final approval hearing was scheduled for November 5, 2026 (per The Dartmouth, September 28, 2026). That deal covers Dartmouth's class only. It is not a Penn settlement and says nothing about what Penn would pay.
UPenn Breach and Lawsuit Timeline
October 31, 2025 — The Halloween Email
Fake messages styled as Graduate School of Education email reach students and alumni. Penn reports it to the FBI. On November 1 the attackers post internal files.
November 3, 2025 — First Class Action
Kelly v. University of Pennsylvania, No. 2:25-cv-06234, is filed in the Eastern District of Pennsylvania, alleging negligent data security.
December 1–2, 2025 — Oracle Breach Disclosed
Penn notifies people that data was taken from its Oracle E-Business Suite system. A Maine filing lists 1,488 people.
December 18, 2025 — Cases Consolidated
Judge Mary Kay Costello merges the related Penn suits under the Kelly docket.
February 2, 2026 — Fewer Than 10 People
A plaintiffs' filing says Penn confirmed the October 31 breach affected fewer than 10 people, none of them plaintiffs. Several plaintiffs drop out.
April 2026 — Moved to Texas
The consolidated case is transferred to In re Oracle Corporation Data Breach Litigation, No. 1:25-cv-01805. As of October 17, 2026, no Penn settlement is announced.
Three Things to Watch For
The breach began with fake Penn email, and donor names, addresses and giving histories are now public. That makes Penn affiliates easy targets:
Fake Penn donation or alumni appeals
The leaked donor files give scammers your name, address and past gifts. A message that cites your giving history is not proof it came from Penn. Give only through a site you reach on your own.
“Claim your Penn settlement” messages
There is no Penn settlement and no claim form. The only claim process we found in the Texas case, as of October 17, 2026, is Dartmouth's, and it covers Dartmouth's class only. Anyone asking Penn alumni for a Social Security number or a fee to “file” is phishing.
Calls posing as Penn IT or security
Penn warned its community to be wary of suspicious calls and emails after the breach. The original attack used stolen credentials, so never give your PennKey password or a login code to anyone who contacts you first.
UPenn Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
What was the UPenn Halloween email?
On October 31, 2025, students and alumni received a fraudulent message made to look like it came from Penn's Graduate School of Education. It said Penn had been hacked. Penn reported it to the FBI and said stolen credentials had been used to reach development and alumni systems.
How many people were affected?
For the October 31 incident, Penn says fewer than 10 people had personal information exposed and were notified. The attackers had claimed 1.2 million. The separate Oracle breach was larger: a Maine filing lists 1,488 people, and a February 2026 court filing described it as affecting hundreds of thousands.
Is there a UPenn settlement or a claim form?
No. As of October 17, 2026, Penn has not announced a settlement, and no claim form or deadline exists for Penn breach victims. A notice of settlement entered in the Texas case on October 15, 2026 does not say which defendant it covers.
Where is the lawsuit now?
It began as Kelly v. University of Pennsylvania, No. 2:25-cv-06234, in Philadelphia federal court. In April 2026 it was transferred to the Western District of Texas, into In re Oracle Corporation Data Breach Litigation, No. 1:25-cv-01805.
How do I check if my email has a data breach?
Search your address on Have I Been Pwned. It lists a University of Pennsylvania breach, added February 16, 2026, covering about 624,000 email addresses along with names and physical addresses. Being listed there does not by itself make you a class member.
Is UPenn in financial trouble?
That is a separate question from this lawsuit, and this page does not cover Penn's finances. For scale, BleepingComputer reported that Penn's endowment stood at $24.8 billion on June 30, 2025, the end of its fiscal year; Penn's own financial reports are the place to look.
Is this the same as the Dartmouth Oracle settlement?
No. Dartmouth settled its part of the same Texas case for $750,000. That deal covers Dartmouth's class only. Penn is a separate defendant and has not announced a settlement.
What is worth doing right now?
Keep any Penn letter about the Oracle breach. Treat calls, texts and donation requests that mention your Penn history with suspicion. Change any reused passwords, and consider a free credit freeze at all three bureaus. For a different Penn case, see our Penn Medicine MyChart lawsuit page.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.