1. [News](/news) 2. Penn data breach: 306,000 records compromised in ShinyHunters attack # Penn data breach: 306,000 records compromised in ShinyHunters attack A data breach involving Penn was reported in May 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team May 9, 2026 Table of Contents * [What happened in the Penn data breach?](#what-happened-in-the-penn-data-breach) * [Who is behind the incident?](#who-is-behind-the-incident) * [Impact and risks for Penn customers](#impact-and-risks-for-penn-customers) * [How to protect against similar security incidents](#how-to-protect-against-similar-security-incidents) ## Key facts: Penn data breach * Date occurred May 3, 2026 * Date discovered May 7, 2026 * Date reported May 7, 2026 * Target entity Penn * Source of breach Ransomware group ShinyHunters * Data types Emails, names, Penn ID numbers, course enrollments * Status Confirmed; reported on May 7, 2026. * Severity Medium; exposure of university-specific identifiers and contact info increases the risk of targeted phishing and identity fraud. ## What happened in the Penn data breach? Penn (upenn.edu) experienced a significant security incident involving its Canvas learning management system, which was publicly reported on May 7, 2026. The breach was attributed to the cybercrime group ShinyHunters, who targeted the third-party provider, Instructure. This supply chain attack resulted in unauthorized access to Penn’s specific Canvas environment, disrupting student access and potentially compromising the personal data of 306,000 affiliates. The incident is classified as a medium-severity data leak. The stolen information includes student and staff names, email addresses, Penn ID numbers, and course enrollment records. ShinyHunters has set a deadline of May 12, 2026, for the university to respond to their demands or face the release of the stolen data. While the investigation is ongoing, such incidents typically lead to increased risks of social engineering and credential-based attacks. ## Who is behind the incident? ShinyHunters is a well-known cybercriminal group that has been active since at least 2020. The group is notorious for targeting high-profile organizations and stealing large datasets to sell on dark web forums or use for extortion. ShinyHunters often gains access through compromised credentials or by exploiting vulnerabilities in third-party service providers. This specific attack on Penn follows a pattern of targeting educational institutions and their vendors, as evidenced by their previous breach of Penn in late 2025 where thousands of internal files were leaked. ## Impact and risks for Penn customers The breach primarily impacts students, faculty, and staff at Penn whose personal and academic information was compromised. With the exposure of names, Penn ID numbers, and emails, affected individuals face a heightened risk of targeted phishing campaigns, identity theft, and unauthorized access to university accounts. The disruption of the Canvas platform also impacts academic continuity and administrative operations. To mitigate these risks, users should remain vigilant against suspicious communications and monitor their accounts for unusual activity. Implementing phishing-resistant multi-factor authentication and updating account passwords are critical steps for protection. Transparency from the university and third-party vendors is essential for ensuring all affected parties can take timely action to secure their digital identities. ## How to protect against similar security incidents Following the breach of Penn’s Canvas site and the exposure of Penn ID numbers and emails, it is vital for students and staff to secure their digital identities. * **Implement phishing-resistant multi-factor authentication.** Enable multi-factor authentication (MFA) on all university and personal accounts. Prioritize hardware security keys or app-based authenticators over SMS-based codes to prevent interception. * **Monitor for targeted phishing attempts.** Be cautious of emails or messages requesting sensitive information or directing you to login pages. Verify the sender’s identity and avoid clicking links in unsolicited communications related to the Penn breach. * **Update credentials and use a password manager.** Change passwords for your Penn account and any other services where you used the same credentials. Use a password manager to generate and store unique, complex passwords for every platform. * **Enhance third-party risk management.** Organizations should implement continuous monitoring of third-party vendors like Instructure. Deploy attack surface management tools to identify and remediate vulnerabilities across the digital supply chain. > Staying informed and proactive is the best defense against the long-term risks of a data breach. ## Frequently asked questions ### What happened in the Penn security breach? ShinyHunters claimed responsibility for a security attack on Penn (upenn.edu) in May 2026. The incident was first reported on May 7, 2026. ### When did the Penn breach occur? The Penn breach was publicly reported on May 7, 2026. ShinyHunters referenced the incident around that time, but the attack may have occurred earlier, possibly starting with the Instructure breach on May 3, 2026. ### What data was exposed? The types of data involved in the Penn incident include names, email addresses, Penn ID numbers, and course enrollments. ShinyHunters has claimed to have compromised the data of 306,000 Penn affiliates. ### Is my personal information at risk? If you interacted with Penn, there’s a possibility your personal information could be affected. Similar incidents often involve email addresses, login details, or academic records. Stay alert for updates and take precautionary measures to secure your accounts. ### What steps should companies take after being breached? Penn is expected to secure its systems, notify affected parties, and provide guidance on protective actions. The university should also review its third-party security measures and deploy attack surface management to prevent future supply chain incidents. ## Is your organization exposed to a similar risk? UpGuard continuously monitors vendors for exposed credentials and infrastructure risk, so you can catch the next breach before it becomes a headline. [Start your free trial](https://cyber-risk.upguard.com/register/trial) Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](https://www.upguard.com/instant-security-score?) ## Latest news Stay up-to-date with the latest news in cybersecurity. * ### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 20, 2026 * ### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 17, 2026 * ### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. UpGuard Team July 16, 2026 * ### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 [View all news](/news) ## Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights.