Have you considered contacting the org's abuse email (security@upenn.edu), detailing the above, and asking for an investigation?

The IP doesn't have a negative reputation on Virustotal, which may mean whoever did it was a real person and it was a targeted attack.