Overview
Data stolen in a November 2025 breach of Harvard University's Alumni Affairs and Development systems is linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned (HIBP), which counted about 851,000 addresses (roughly 850,500 accounts). Harvard has not said how many individuals were affected.
Harvard discovered the intrusion on November 18, 2025.
What Was Exposed
According to the article, attackers accessed personal information of students, alumni, donors, staff, and faculty, including:
- Email addresses and phone numbers
- Home and business addresses
- Event attendance records
- Donation details
- Biographical information tied to fundraising and alumni engagement
Harvard CIO Klara Jelinkova said the affected systems did not store Social Security numbers, passwords, payment card data, or financial information.
Attribution and Extortion
Harvard has not named a threat actor. The ShinyHunters extortion gang claimed responsibility and said it stole over 1 million records. Harvard refused to pay, and in early February ShinyHunters leaked a 1.1 GB archive on its leak site.
Related Incidents
- In October 2025 Harvard said it was investigating a separate breach; the Clop gang claimed it exploited an Oracle E-Business Suite zero-day.
- Princeton and the University of Pennsylvania disclosed donor-related breaches in November 2025.
- The University of Phoenix reported that Clop stole data on nearly 3.5 million people through the same Oracle flaw in August 2025.
What Affected People Should Do
- Check your email address on Have I Been Pwned.
- Expect targeted phishing that references donations, events, or alumni activity; verify any fundraising request through official channels.
- Be cautious of calls or texts using personal details from the leak.
- Although passwords were reportedly not stored in these systems, reused credentials elsewhere remain worth rotating if you have any doubt.