"Penn sent notifications to the limited number of individuals whose personal information was impacted as required by applicable notification laws," the school said.