The Key — After the Breach: An Opportunity to Combat Mistrust
Last Friday, the subject line “We got hacked (Action required)” landed in hundreds of thousands of inboxes across the Penn community from email addresses linked to Penn’s Graduate School of Education.
The spam message accused Penn of being “completely unmeritocratic,” “breaking federal laws like FERPA,” and not complying with “Supreme Court rulings like SFFA” (Students for Fair Admissions). After the emails were sent, the hacker leaked information on alumni, donors, and students, internal university memos, and banking information, and claimed to be selling more.
The security breach was not just a technical failure. It exposed a deeper confidence crisis between Penn and its community. The hacker’s sentiments reflect a general frustration with elite institutions like Penn, and the reactions from alumni reveal limited confidence in the institution to protect its community.
Penn swiftly acknowledged the breach, reported it to the FBI, and published a page with information for the university community. But a key question remains: How does Penn plan to earn back the trust of the public and its own community?
A critical first step is transparency. Penn should tell its community exactly what data was compromised, how further breaches will be prevented, and how it plans to protect compromised community members. Prompt, public accountability and action would demonstrate that Penn can handle a crisis and take responsibility for its own recovery.
A crisis bigger than cybersecurity
Although the message from Penn’s hacker is unique in its vulgarity and method, it is not unique in its sentiment. In a moment when almost 30% of the American public considers Ivy League schools to be “the enemy,” labeling Penn as an “elitist institution” does not come as a surprise.
As we’ve discussed, the American public’s trust in higher education is near historic lows. This distrust is especially evident on the right, with only 26% of Republicans expressing a great deal or quite a lot of confidence in higher education. But with only 66% of Democrats feeling that level of confidence, it’s still a near-failing grade from the left as well.
In a recent interview with New Yorker editor David Remnick, liberal political commentator Jon Stewart said, “The institutions that we spoke about earlier [including academia] have problems. They do… Credibility is not something that was just taken, it was also lost.”
The federal government’s Compact for Academic Excellence in Higher Education is another manifestation of the same mistrust. The Trump administration is channeling its belief that higher education requires external reform because of universities’ misaligned priorities and an inability to make change from within.
The details of the Compact may be flawed, but the impulse behind it is clear. Americans want accountability and change from the nation’s universities.
Outrage from alumni
A new avenue for mistrust just opened for Penn alumni: the insecurity of their data. In the past week since the breach, at least four separate lawsuits have been filed against the university, accusing it of negligence and insufficient data security.
Some of the stolen data was leaked, including personal information about alumni, private notes on donor families, and internal memos. The hacker also claims to have exported data focused on “1.2 million University of Pennsylvania students, alumni, and donors,” a staggering breach for any institution.
Interim VP of Information Technology & Interim Chief Information Officer Josh Beeman said in a Wednesday community message that the university is “working diligently to address” the breach.
However, many across the Penn community are left wondering what was exposed. Penn’s leadership has yet to publish an actionable plan to protect further community data and begin earning back trust. Without clear answers, anxiety fills the void.
Penn’s chance to prove its commitment to change
Although the security breach appears to be an isolated incident, it is not the only recent event that has bred mistrust from the Penn community and beyond. Over the past two years, leadership upheaval, rising campus antisemitism, tightening of protest policies, and a rapidly changing federal funding environment have left the community with existential questions about the future of the university.
Penn’s leadership has begun responding. The new strategic framework, In Principles and Practice, plans to combat antisemitism and overall hate on campus, and the creation of Penn Forward promises a plan for a new era of higher education.
Frameworks and committees are helpful tools, but they do not alone amount to institutional change.
The community is still looking for specifics, starting with specific plans and followed by specific outcomes. The data breach gives Penn’s leadership a chance to demonstrate transparency and begin rebuilding trust. Penn must clarify what data was compromised, outline protections for affected individuals, and share details of new security measures.
Perceived secrecy risks perpetuating mistrust. A swift, transparent, and actionable plan to respond to the data breach may demonstrate Penn’s ability to handle a crisis and begin restoring confidence.
The Almanac
Graduate student union schedules strike vote for mid-November
The decision comes as GET-UP and Penn have been in ongoing negotiations since October 2024 for a graduate student contract. Bargaining sessions so far have resulted in tentative agreements on 20 proposals, but key economic negotiations remain unresolved, including an increased minimum PhD student stipend.
So what? In anticipation of potential strikes, Penn’s Office of the Vice Provosts of Education released guidance to course instructors and department chairs on maintaining academic continuity in the instance of a strike. Penn’s chapter of the American Association of University Professors (AAUP) published opposing guidance titled, “Don’t be a strikebreaker.” This tension suggests that if a strike is launched, Penn’s leadership will face opposition from interest groups beyond just GET-UP as it fights to maintain academic operations.
Administrative staff layoffs announced at School of Social Policy and Practice
Dean Sara Bachman, who was recently reappointed for a second six-year term at the School of Social Policy and Practice (SP2), announced an 8% staff cut in an email last week. She explained that the decision came after consideration of alternative cost-saving strategies and will be accompanied by other tactics.
This year, Penn’s leadership has emphasized cost containment as federal funding becomes less reliable. So far, cost saving plans have included hiring freezes, reductions to PhD admissions, and limiting of capital expenditures. SP2’s layoffs are the first, but likely not the last, workforce reductions amid financial uncertainty.
So what? In our recent discussion of Penn’s desire for expansion, we highlighted a challenge in the university’s strategy: an apparent emphasis on growth for growth’s sake. This focus was accompanied by a surge in administrative and staff roles across the university to support mushrooming operations. SP2’s layoffs may represent a turning of the tide. In a time of financial uncertainty, Penn may need to cut costs rather than just containing them to ensure adequate funds for academics and research. Lowering staff counts may be an impactful place to start these changes.
Penn wins summary judgment in case of third-party harassment by former employee
O’Neill’s case, originally filed in March, claimed that harassment by a Penn student amounted to violations of Title VII of the Civil Rights Act and the Philadelphia Fair Practices Ordinance by Penn. Judge Kearny’s decision last week cited a recent Sixth Circuit case that requires proof that the employer intended to cause harm or was “substantially certain its actions would cause harassment” to be held liable for third-party misconduct. Kearny ruled O’Neill did not provide sufficient evidence to prove that Penn was “liable under federal law when the student harasser is not a university employee.”
So what? The precedent cited in this decision, from an August decision in the Sixth Circuit in Michigan, represents a new normal in which employers potentially hold less responsibility for actions impacting their employees at work by third-party actors. The summary judgment granted in favor of Penn may represent a new era of litigation where universities like Penn, and other employers alike, hold less legal responsibility for actions on its premises.
Thank you for reading the Franklin’s Forum newsletter! We love connecting with our readers — send us your thoughts and questions, Penn news, and ideas for future issues. If you enjoyed this edition, please spread the word by forwarding it to friends and classmates.