Penn Phases Out Text-Based Two-Factor Authentication

The University of Pennsylvania is ending text message and phone call verification for PennKey holders after a run of cyberattacks on campus systems.

Updated on Nov. 10, 2026 in Cybersecurity

Isometric editorial illustration of a single unlabeled hardware security key resting on a slate surface in muted slate, teal, and cream tones. — The University of Pennsylvania is ending text-message and phone-call two-factor authentication for PennKey holders after a series of cyberattacks, including a leak of internal files by ShinyHunters. AI Illustration. Upload story photo >

Live Poll

Do you trust large institutions to keep your personal data secure?

Penn announced this month that it is beginning to phase out text messages and phone calls as two-factor authentication methods for PennKey holders. The move follows a series of breaches, including a October incident in which attackers sent mass spam from Penn-affiliated addresses and the publication of internal files by the ShinyHunters group.

Why it matters

Penn cites industry standards and security concerns in shifting away from text and call verification, which are considered weaker than other authentication methods. Experts said the university may need to keep revising how it manages security threats as attacks continue to grow in volume.

Penn's firewall blocked 5.8 billion attacks a month in fiscal year 2025, up from 4.1 billion in the prior reporting cycle, according to university figures. The source does not specify how much of the roughly 306,000 affected-user figure was confirmed by Penn versus claimed by the attackers.

The players

University of Pennsylvania (Penn)

A private Ivy League research university in Philadelphia whose IT department manages PennKey authentication and campus cybersecurity.

ShinyHunters

A cybercrime group that has claimed responsibility for data breaches at multiple organizations and published stolen Penn files after demanding a ransom.

The details

The change affects PennKey holders, who will no longer be able to use text messages or phone calls as second-factor verification. The shift comes after ShinyHunters, which said Penn refused to pay a million-dollar ransom, published thousands of internal files including donor records and memos.

Last October: Mass spam emails were sent from Penn-affiliated addresses after a security breach.
Last November: Penn identified a breach of its Oracle E-Business Suite that affected nearly 100 organizations.
May: ShinyHunters claimed a breach of Instructure, parent company of Canvas, affecting roughly 306,000 Penn users.
This month: Penn announced it is phasing out text and phone call two-factor authentication.

Industry Context

Microsoft's monthly software patches rose from 79 in March to more than 1,400 in October, a pace that mirrors the rising firewall block volume Penn reports. Penn's shift away from text-based verification reflects the broader security community's move toward stronger authentication methods as attack volume grows.

PennKey holders will need to set up an alternative second-factor method, such as an authenticator app, as text and phone call verification is retired. Anyone relying on these prompts for campus accounts should review their sign-in settings before the change takes effect.

The takeaway

Turning on an authenticator app or security key for your university account is a practical step that is harder for attackers to intercept than text-message codes.