University of Pennsylvania SSO Breach Exposes 1.2 Million Records

In 2025, the University of Pennsylvania suffered a significant data breach due to a compromised single sign-on (SSO) account. Attackers accessed the PennKey SSO, infiltrating internal systems including VPN, Salesforce, Qlik, SAP, and SharePoint. This breach affected 1.2 million individuals, highlighting the risks associated with SSO authentication. While SSO offers benefits like reduced password sprawl, its security relies on robust protection measures. The National Institute of Standards and Technology (NIST) recommends strong password policies, including a minimum of 15 characters for single-factor authentication and 8 characters for multi-factor authentication (MFA). Additionally, MFA should be enforced consistently across all users and access scenarios, with a shift towards more secure methods like FIDO2 security keys. Organizations must also secure identity provider administrator accounts and review permissions to mitigate risks.

Key Points: • The University of Pennsylvania breach compromised 1.2 million records via SSO. • Attackers exploited a PennKey SSO account to access multiple internal systems. • NIST recommends strong password policies and consistent MFA enforcement for SSO security.