The full scale of last year's data breach at Harvard University is finally clear. Breach notification service Have I Been Pwned (HIBP) has added the leaked Harvard data to its database, and it contains about 851,000 unique email addresses tied to the university's alumni and fundraising systems, along with detailed personal profiles of donors, alumni, parents and some students and staff.
What happened
Harvard discovered on November 18, 2025 that an unauthorized party had gotten into information systems used by its Alumni Affairs and Development office. According to the notification letters the university sent out a few days later, the attacker got in through a phone-based phishing attack, where a caller tricks an employee into handing over access. Harvard said it cut off the intruder's access right away and brought in law enforcement and outside cybersecurity experts.
Harvard has not publicly named who was behind the attack. However, the ShinyHunters extortion gang claimed responsibility, saying it took more than a million records containing personal and donation details. When the university did not pay to have the data deleted, the group posted a 1.1GB archive of stolen files on its dark web leak site in early February 2026.
At the time, Harvard did not say how many people were affected. That gap has now been filled: on November 3, 2026, HIBP analyzed the leaked files and listed the breach with 850,537 affected accounts.
Who is affected
Harvard said the exposed records relate to people connected with its fundraising and alumni engagement work, including:
- Alumni, and their spouses, partners and surviving spouses
- Donors to the university
- Parents of current and former students
- Some current students
- Some faculty and staff
What data was exposed
Harvard's own disclosure listed email addresses, phone numbers, home and business addresses, event attendance, donation details and other biographical information used for fundraising. HIBP's review of the leaked data shows just how detailed those profiles are. Among the types of data it found are:
- Names, dates of birth and places of birth
- Email addresses, phone numbers and physical addresses
- Charitable donation records
- Employers, job titles, occupations and education levels
- Gender, ethnicity, marital status and citizenship status
- Names of family members
- Social media profiles
The university's chief information officer, Klara Jelinkova, said the affected systems did not hold Social Security numbers, passwords, payment card details or other financial information.
Part of a wider pattern
Harvard was not the only Ivy League school hit last fall. Princeton University and the University of Pennsylvania both disclosed breaches in November 2025, and both confirmed that donor information was accessed. Wealthy, well-connected donor lists are valuable to criminals because they make it easier to craft convincing scams.
The alumni breach is also separate from another incident Harvard investigated in October 2025, after the Clop ransomware gang claimed it had breached the school using a zero-day flaw in Oracle E-Business Suite. Clop used the same flaw against other universities, including the University of Phoenix.
What you should do
Because no passwords or financial data were in the stolen systems, the main risk here is targeted phishing and fraud. Criminals who know your donation history, family members and employer can write very believable messages. If you have ties to Harvard:
- Check whether your email address appears in the breach at Have I Been Pwned.
- Be suspicious of any call, text or email claiming to be from Harvard, especially ones asking for a password reset, a donation, or sensitive details like your Social Security number or bank information.
- Verify unexpected requests by contacting the university through a phone number or website you look up yourself, not one given in the message.
- Watch out for scams that mention your family, employer or past gifts to make them seem legitimate.
- Consider a credit freeze if you are worried about identity theft, since birth dates and addresses were exposed.
For organizations, the lesson is that a single convincing phone call can open the door. Staff who handle sensitive records should be trained to verify callers, and help desks should use strict identity checks before resetting accounts or granting access.
0 Comments