Skip to content
Penn Phasing Out Text and Call Authentication Amid Cybersecurity Concerns

Penn Phasing Out Text and Call Authentication Amid Cybersecurity Concerns

First seen 6 Nov 2026, 13:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 13:16 UTC
  • •Penn will retire text and call authentication methods by February 23, 2027.
  • •Approximately 25% of PennKey users currently use these less secure methods.
  • •The change follows a major cyberattack that compromised university data.

The University of Pennsylvania will discontinue text message and phone call methods for two-step authentication for PennKey users starting February 23, 2027. This decision affects approximately 25% of users currently relying on these methods, which are considered less secure due to vulnerabilities like SMS interception. Users must transition to more secure alternatives such as Duo Mobile with Verified Push or biometric identification. The change follows a significant cyberattack in October 2026 by the hacker group ShinyHunters, which exposed internal university files. Affected users will receive weekly reminders starting November 10, 2026, to update their authentication methods. The initiative is part of a broader effort to enhance cybersecurity across the university's systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3h ago How this analysis works

Timeline

2026-10-13
Text/SMS and Phone Call methods disabled for new users
Penn stopped allowing new enrollments for text and call authentication methods.
Thedp
2026-11-10
Weekly reminders for affected users begin
Users relying on text/SMS and phone call methods will receive reminders to set up new authentication methods.
Thedp
2027-02-23
Retirement of Text/SMS and Phone Call methods
Text/SMS and Phone Call methods for PennKey Two-Step Verification will officially end.
isc.upenn.edu

More articles in this cluster (6)

Following this threat?

Track shinyhunters and Penn in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 4

Common questions

What methods will replace text and call authentication?
Users will need to transition to Duo Mobile with Verified Push or biometric identification.
How will this change affect current users?
Users relying on text/SMS and phone call methods must set up a new authentication method by February 23, 2027.
What prompted this change?
The decision follows a significant cyberattack that exposed university data and highlighted vulnerabilities in current authentication methods.