Two major universities—Princeton and the University of Pennsylvania—have just experienced significant cybersecurity incidents affecting advancement, alumni, and donor data.

 

• At Princeton, attackers gained access to advancement-related university data through a phone-based social engineering attack, convincing an employee to provide access.

 

• At UPenn, hackers claim to have stolen over one million records, including donor, alumni, and internal information.

 

These incidents underscore a sobering reality: Advancement data is a high-value target, and attackers are increasingly bypassing technology by exploiting people—especially those with access to constituent databases. And most breaches today happen not because of a system failure, but because a human was tricked.

 

This message is a firm call to action for anyone with access to any UVA Advancement database, platform, or donor/alumni information:

 

1. STOP before clicking links or opening attachments

 

Phishing is the #1 way donor-data breaches start.

Do not click on:

• Unexpected DocuSign/SharePoint/OneDrive links
• Emails that look like account alerts, MFA resets, or vendor updates
• LinkedIn messages asking you to “approve” an app or data connection
• Attachments you didn’t request

 

If you did not expect it, treat it as suspicious.

 

2. REMEMBER: Social engineering also happens by phone and text

 

One of the recent university breaches occurred when an attacker called an employee and impersonated a support provider.Attackers frequently use:

 

• Phone calls claiming to be IT, Microsoft, Salesforce, or a vendor
• Text messages urging urgent MFA resets or login confirmations
• Voicemail requests to “verify your account”

 

No one from UVA, ITS, Advancement Operations, or any vendor will ever ask you for passwords, Duo codes, or database access over the phone or via text.

 

If you get a call or text like this, hang up and report it.

 

3. NEVER approve or install any “connected app” or integration

 

Recent attacks across higher ed and the corporate sector involve malicious OAuth apps pretending to be Salesforce, Outlook, Zoom, or LinkedIn tools.

 

Do NOT approve:

• Any pop-up asking to “Connect your Microsoft account”
• Any request to “Allow access to your CRM data”
• Any third-party plug-ins, extensions, or browser add-ons

 

If something like this appears, stop and contact [email protected] immediately.

 

4. Protect your login like donor data depends on it (…because it does).

 

• Use strong, unique passwords
• Never send screenshots of system pages or donor records
• Lock your screen when you step away

 

Even small lapses can lead to large breaches.

 

4. Do not store donor or alumni data outside approved systems

 

This includes:

• Personal Dropbox/Google Drive accounts
• Spreadsheets saved to desktops
• Emailing spreadsheets to yourself
• Saving data to personal devices

 

If you need a secure place to store or work with data, ask us—never improvise.

 

6. Report anything suspicious immediately

 

If something feels “off” — a strange login prompt, a file you didn’t expect, a request for data from someone claiming to be a vendor — do not ignore it. Contact IT Security [email protected] or Advancement Operations right away.