Identity and Access Management

## Executive Summary: University of Pennsylvania Dual-Breach (2025)

The University of Pennsylvania (Penn) experienced a sophisticated “one-two punch” cyberattack in late 2025, serving as a critical case study for the **”Assume Breach”** security philosophy. Within a single month, the institution was struck by two distinct attack vectors, proving that high-value targets are often subject to persistent, multi-layered threats.

### The Incidents

* **Breach A (October 2025):** Attackers utilized social engineering to hijack a **PennKey Single Sign-On (SSO)** account. By bypassing Multi-Factor Authentication (MFA) on accounts with “convenience exemptions,” the actors moved laterally to compromise SharePoint, alumni databases, and Salesforce Marketing Cloud.
* **Breach B (November 2025):** While the university was in the recovery phase, the **Clop ransomware group** exploited a zero-day vulnerability (**CVE-2025-61882**) in the **Oracle E-Business Suite (EBS)**. This technical exploit allowed for Remote Code Execution (RCE) and direct data theft from core financial and supplier systems without requiring credentials.

### Impact and Disclosure

The breach resulted in the exposure of sensitive **Personally Identifiable Information (PII)** belonging to approximately 1,500 individuals, primarily within donor and alumni records. The incident became public through a three-wave disclosure: initial “appetizer leaks” and mass mockery emails sent by the attackers, followed by discovery on the Dark Web by security researchers, and finally an official confirmation by the university on November 5, 2025.

### Response and Mitigation

Penn’s response strategy focused on **containment and remediation**:

* **Immediate Lockdown:** Compromised PennKey accounts were locked, and affected Oracle EBS servers were disconnected from the internet.
* **Technical Fixes:** An emergency critical patch from Oracle was applied to close the zero-day vulnerability.
* **External Collaboration:** The university partnered with the **FBI** and **CrowdStrike** for digital forensics and a federal probe.
* **Victim Support:** Affected individuals were provided with 24 months of credit monitoring services.

### Strategic Lessons

The dual-breach highlights the danger of the **”Convenience Gap,”** where VIP MFA exemptions create “Golden Tickets” for intruders. Moving forward, the university and similar institutions must adopt **Identity-First Security** and **Zero-Trust Architecture**. Key preventive measures include universal MFA enforcement, network micro-segmentation to prevent lateral movement, and the deployment of Web Application Firewalls (WAF) for virtual patching against future zero-day exploits