Class Action Accuses Princeton University of Failing to Protect Decades of Alumni Data

Case Overview: The lawsuit accuses Princeton of failing to protect personal data exposed in a 2025 cyberattack.

Consumers Affected: Students, alumni, donors, and employees whose records were stored in Princeton’s Advancement system.

Court: U.S. District Court for the District of New Jersey

Princeton University is accused in a new lawsuit of failing to protect highly sensitive personal information stored in its Advancement database, exposing generations of alumni, students, faculty, donors, and their families to identity theft. 

The complaint claims the university left unencrypted data vulnerable to hackers and did not take basic steps to prevent or quickly detect a cyberattack, despite years of warnings that higher-education institutions were becoming prime targets.

Cybercriminals infiltrated Princeton’s systems on November 10, through a phone-phishing attack aimed at an employee with access to the Advancement database, the lawsuit states. 

The breach compromised a wide range of details including names, contact information, dates of birth, family relationships, professional history, donation records, and more. 

Princeton has acknowledged the incident but has said it still does not know exactly what information was accessed or removed.

Former Student Says Princeton Ignored Cybersecurity Warnings

Massachusetts resident and Princeton alum Gary Penna is behind the proposed class action lawsuit, where he says he provided his personal information because the university represented that it would be safely stored, used only for legitimate purposes, and deleted when no longer needed.

Instead, the lawsuit claims Princeton kept years of sensitive data unencrypted on systems known to be targeted by hackers. After the breach, Penna says he has spent hours monitoring credit and financial accounts, investigating the incident, and taking steps to guard against identity theft, which he expects will continue indefinitely. 

He says in the lawsuit he believes he will have ongoing anxiety, loss of privacy, and the likelihood that his information has already circulated on the dark web.

Hackers Reportedly Accessed Sensitive Advancement Database Files

Over the years, Princeton retained enormous volumes of personal data, the lawsuit alleges, but failed to update its cybersecurity protections. It says Princeton could have prevented the breach with basic measures such as modern encryption, access controls, employee training, logging, and intrusion detection systems.

Penna also argues Princeton was on notice with other elite universities, including UPenn, Georgetown, Columbia, NYU, and Stanford, having all recently suffered similar attacks.

Despite this, the lawsuit says Princeton continued storing sensitive personal data in a vulnerable condition and waited days to notify many affected individuals.

The university’s Advancement office, which manages decades of donor and alumni records, retained much of this information “in perpetuity,” according to public statements referenced in the complaint. That practice, the lawsuit claims, increased the harm by enlarging the pool of exposed individuals.

Growing Legal Fallout Over Data Security

The data breach lawsuit lands as Princeton faces other legal pressure. In a prior case, Princeton agreed to pay more than $1 million to resolve federal claims that female full professors were underpaid. 

Meanwhile, data breach cases are rising across industries, with companies including MLB, Cohen’s Fashion Optical, Union Home Mortgage, Allianz Life, and Victoria’s Secret facing their own class action lawsuits over large-scale exposures.

Fighting Princeton. Penna wants to represent all students, alumni, donors, faculty, staff, and connected individuals whose information was housed in the Advancement database. 

The Princeton data breach class action lawsuit seeks damages plus court-ordered measures requiring Princeton to fully disclose what was taken, improve its cybersecurity practices, and provide lifetime identity-theft protection for all affected.

Case Details

• Lawsuit: Penna v. Princeton University
• Case Number: 3:25-cv-17854   
• Court: U.S. District Court for the District of New Jersey, Trenton Division 

Plaintiffs' Attorney:

• Andrew W. Ferich (Ahdoot & Wolfson, P.C.)

Have you ever had personal data exposed in a breach? Share how you handled it in the comments.