University of Pennsylvania data breach class action lawsuit overview:
- Who: Plaintiff Christopher F. Kelly filed a class action lawsuit against the University of Pennsylvania.
- Why: Kelly claims UPenn failed to protect and safeguard the personally identifiable information of students, applicants and faculty.
- Where: The class action lawsuit was filed in Pennsylvania federal court.
A new class action lawsuit accuses the University of Pennsylvania of failing to protect the personally identifiable information (PII) of students and faculty exposed in a recent data breach that became public through a Halloween email blast sent by a purported hacker claiming to have accessed UPenn’s data.
Plaintiff Christopher F. Kelly filed the class action complaint against the University of Pennsylvania on Nov. 3 in a Pennsylvania federal court, alleging violations of state and federal consumer laws.
The University of Pennsylvania data breach occurred on or around Oct. 31, 2025, when “unknown actors” allegedly infiltrated university email accounts and used them to send a mass Halloween email blast warning recipients that “all your data will be leaked.”
The breach resulted in unauthorized access to the PII of students and faculty, including names, addresses, and Social Security numbers, the lawsuit says.
According to the class action lawsuit, the emails were sent from compromised “@upenn.edu” accounts linked to the Graduate School of Education, and were distributed to students, faculty, alumni, and parents—alerting many to the breach before UPenn issued any direct notice.
Since the data breach, Kelly reports receiving more spam emails, spam texts, and spam phone calls and that “the cybercriminals are in possession of his sensitive [personally identifiable information],” the suit states.
UPenn failed to implement adequate data security measures, lawsuit alleges
The class action lawsuit alleges that the University of Pennsylvania has failed to implement adequate data security measures, despite collecting and storing sensitive personal information from students and faculty.
Kelly claims that the university’s negligence allowed cybercriminals to access and potentially misuse the PII of affected individuals.
The class action lawsuit further alleges that the university was aware of the risks associated with cyberattacks but did not take sufficient steps to protect the data.
Despite generating significant revenue, the university chose not to invest in robust data security measures, the UPenn data breach class action lawsuit says.
As a result of the breach, Kelly alleges that affected individuals face an increased risk of identity theft and other forms of fraud.
The lawsuit seeks to represent a class of individuals whose PII was compromised in the data breach. Kelly is demanding a jury trial and requesting damages, including compensation for identity theft, lost time, and expenses related to mitigating the harm caused by the breach.
The lawsuit also seeks injunctive relief to prevent future data breaches and ensure that the university implements adequate data security measures.
Last month, the University of Minnesota agreed to a $5 million settlement to resolve claims it failed to prevent a similar data breach in 2021.
Were you affected by the University of Pennsylvania data breach? Let us know in the comments.
The plaintiff is represented by Randi Kassan of Milberg PLLC and William B. Federman, Jessica A. Wilkes and Jonathan Herrera of Federman & Sherwood.
The University of Pennsylvania data breach class action lawsuit is Kelly, et al. v. University of Pennsylvania, Case No. 2:25-cv-06234, in the U.S. District Court for the Eastern District of Pennsylvania.
Don’t Miss Out!
Check out our list of Class Action Lawsuits and Class Action Settlements you may qualify to join!
Read About More Class Action Lawsuits & Class Action Settlements:
- LG hit with class action lawsuit over refrigerators that allegedly stop cooling without warning
- WestJet data breach class action alleges 1.2M customers’ info compromised
- Kitten’s death sparks class action lawsuit over ‘unsafe’ Iris USA pet food containers sold on Amazon
- Class action lawsuit says egg producers blamed bird flu to hide price-fixing scheme
3 thoughts onHalloween email scare exposes UPenn data breach, leading to class action lawsuit
Add me
To effect hospitals as well because employees that work for pain medicine or are required to take classes online for certain things depend depending on their level of employment.
To disinfect hospitals as well because employees that work for pain medicine or are required to take classes online for certain things depend depending on their level of employment.