VULNpocalypse
MediumBreach / campaignMonitoring

Harvard alumni data breach: Have I Been Pwned reports 851,000 accounts exposed

BleepingComputer reports Have I Been Pwned found 851,000 Harvard alumni and donor emails in leaked data; check HIBP and expect targeted phishing.

Published
Exploitation
No, the source does not identify a vulnerability or entry point used in this incident

What happened

According to BleepingComputer, breach notification service Have I Been Pwned (HIBP) says it analyzed data leaked from Harvard University’s Alumni Affairs and Development systems. HIBP says the data contained 851k unique email addresses. BleepingComputer reports that the university discovered the intrusion on November 18, 2025.

BleepingComputer reports that Harvard said the attackers accessed personal information of students, alumni, donors, staff and faculty. Harvard listed the following data types:

  • email addresses
  • telephone numbers
  • home and business addresses
  • event attendance records
  • donation details
  • biographical information related to fundraising and alumni engagement

HIBP says the leaked data also includes names, dates of birth, social media profiles and “extensive profile information for donors, alumni, parents and some faculty, staff and students” (BleepingComputer).

Harvard CIO Klara Jelinkova said the affected systems did not store Social Security numbers, passwords, payment card information or financial information (BleepingComputer).

On attribution, BleepingComputer reports the following (BleepingComputer):

  • Harvard has not attributed the attack to any group.
  • The ShinyHunters extortion gang claimed responsibility and says it stole over 1 million records.
  • The gang leaked a 1.1GB archive in early February after Harvard refused to pay.

The 1 million figure is the gang’s claim and is not confirmed. Also not confirmed:

  • how the attackers got in
  • whether any victim count was confirmed by Harvard (a Harvard spokesperson could not share how many individuals were affected)

BleepingComputer separately reports that in October 2025 Harvard said it was investigating a different incident. In that case, the Clop ransomware gang claimed to have breached the university using an Oracle E-Business Suite zero-day. The source does not link that incident to this one (BleepingComputer).

Am I affected?

You may be affected if Harvard’s alumni or fundraising systems hold a record about you. According to HIBP, as reported by BleepingComputer, this includes donors, alumni, parents and some faculty, staff and students.

Passwords and payment data were not in the affected systems, according to Harvard (BleepingComputer).

What to do now

  1. Search your email address on Have I Been Pwned. HIBP is the service that analyzed the leaked data, per BleepingComputer.
  2. Be careful with emails, calls or letters that reference your Harvard affiliation, donation history or event attendance. This type of data was exposed and could make fake messages look convincing.
  3. Verify any donation or account request through a contact channel you already know, not through details given in the message.
  4. Watch for direct notification from Harvard. Whether individuals will be notified is not confirmed in the source.

Sources