Data stolen from Harvard University's Alumni Affairs and Development systems in November 2025 is linked to about 851,000 unique email addresses. That figure comes from the breach notification service Have I Been Pwned (HIBP), which added the dataset on 3 November 2026 and counts 850,537 affected accounts. The ShinyHunters extortion group has claimed the attack and says it took more than 1 million records. It published a 1.1GB archive on its leak site in early February after Harvard refused to pay, BleepingComputer reports. Harvard has confirmed the intrusion but has not given a count of affected people or named who was behind it.
What Happened
Harvard says it found on 18 November 2025 that an unauthorised party had gotten into systems used by its Alumni Affairs and Development office. Several reports say Harvard's disclosure of 22 November 2025 blamed a phone-based phishing (vishing) attack. They also say the university cut off the attacker's access and brought in law enforcement and outside security specialists.
Harvard has not named a threat actor. ShinyHunters claimed the attack and ran what HIBP calls a "pay or leak" extortion attempt. According to BleepingComputer, Harvard refused to pay, and the group posted a 1.1GB archive on its dark web leak site in early February 2026. When BleepingComputer asked at the time, a Harvard spokesperson could not say how many people were affected. That question stayed open until HIBP analysed the leaked data this week.
Two other recent Harvard items have come up alongside this incident. Neither has been shown to be connected:
- A blog post claims the Cl0p ransomware group leaked Harvard payroll records through the MOVEit Transfer vulnerability (CVE-2023-34362). No established outlet or Harvard statement backs this up. It describes a different system, different data and a different actor from the alumni breach, so treat it as unverified and unrelated.
- The Harvard Crimson reports that alumni admissions interviewers now have to certify that they have deleted all applicant data, including reports from past years, after a privacy and security policy review. Harvard has not said why, and nothing ties the change to this breach.
Harvard IT's public news page does not currently mention the incident.
What Was Taken
Estimates of the scale depend on who is counting:
- HIBP: 850,537 accounts, or about 851,000 unique email addresses. This is the only independent count, based on the leaked data.
- ShinyHunters: says it stole more than 1 million records. The group has not proved this, and extortion groups often inflate their numbers.
- Harvard: has not published a figure.
The difference may come from duplicate records, or from records that had no email address and so would not show up in HIBP's count. Nobody has confirmed either explanation.
Harvard's own notice listed "email addresses, telephone numbers, home and business addresses, event attendance, details of donations to the University, and other biographical information pertaining to University fundraising and alumni engagement activities." The affected groups were students, alumni, donors, parents, staff and faculty.
HIBP's analysis of the leaked data lists a much longer set of fields. Harvard's description does not spell most of these out:
- Names, salutations, genders, dates of birth and places of birth
- Ethnicities, citizenship statuses and marital statuses
- Family members' names
- Employers, job titles, occupations and education levels
- Charitable donation histories
- Phone numbers, physical addresses and social media profiles
Harvard CIO Klara Jelinkova has said the affected systems did not hold Social Security numbers, passwords, payment card data or financial account information. Undercode News reports that HIBP found about 64% of the email addresses had already appeared in earlier breaches.
Why It Matters
This is not a credentials leak. It is a detailed profile of wealthy people and their families. A record that pairs donation history, employer, job title, home address, family members' names and ethnicity is exactly what a criminal needs to write a convincing fraud email aimed at a specific person. Likely uses include:
- Fake fundraising or "gift confirmation" emails pretending to be from Harvard
- Business email compromise aimed at the donors' employers
- Wire fraud that uses real gift amounts to seem believable
The data will not go out of date the way passwords do. Birthplaces, family ties and giving history stay accurate for years. People cannot change any of it.
The incident also fits a familiar ShinyHunters pattern: phone-based social engineering of staff to reach business systems, followed by pressure through a leak site. Advancement and fundraising databases at universities are attractive targets. They usually hold decades of constituent data, are open to large administrative teams, and get less security attention than research or finance systems.
The Attack Technique
Reports citing Harvard's November 2025 disclosure say the attacker got in by voice phishing. Homeland411 describes the attacker phoning administrative staff while pretending to be IT support and collecting their login credentials. Harvard has not published technical details. It has not named the platform that was breached, said whether multi-factor authentication was bypassed or enrolled under the attacker's control, or said how the data was taken out.
What is known suggests the attackers wanted data, not disruption. Nobody has reported encryption or ransomware being deployed. The goal was bulk theft followed by an extortion demand.
What Organizations Should Do
- Lock down help desk identity checks. Require callback to a known number, manager approval, or in-person checks before resetting credentials or enrolling MFA devices. Vishing works when a confident caller can talk staff into a reset.
- Use phishing-resistant MFA on CRM and advancement platforms. FIDO2 keys or passkeys cannot be handed over on a phone call the way one-time codes can. Alert on any new MFA device enrolled outside normal channels.
- Watch for bulk exports. Set baselines for normal query and export volume on constituent databases, and alert on large pulls, unusual API use, or access from new locations or devices.
- Cut down what you store. Ask whether fundraising teams really need ethnicity, citizenship, marital status and family details for every record. Harvard's new rule requiring interviewers to delete applicant data is the kind of retention discipline that limits damage from future breaches.
- Warn the people in your data before criminals reach them. Tell donors and alumni how you will and will not contact them about gifts or payments. Give them a way to check whether a message is genuine.
- Have an extortion plan ready. Decide ahead of time who makes the call on a pay-or-leak demand, and prepare notification templates. Harvard's refusal to pay followed by a public leak is now a common sequence.
Sources: Harvard University data breach exposed info of 851,000 accounts | Harvard University Data Breach Exposes 851,000 Alumni & Donors on H... | Harvard data breach: what leaked and what to do — 2-Spyware | Harvard University Data Breach: ShinyHunters Exposed 851,000 Unique... | Harvard Data Breach: What Was Leaked and What to Do (Nov 2026) | News Harvard University Information Technology | Cl0p Leaks Harvard Data: Payroll Records Shared Security Alert - Hu... | Harvard Orders Alumni Interviews to Delete Past and Current Applica...