Harvard University Data Breach Exposed Information of 851,000 Accounts

Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. The university discovered the intrusion on November 18, 2025, and determined that the attackers had gained access to personal information belonging to students, alumni, donors, staff, and faculty members. The exposed data included email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and biographical information related to university fundraising and alumni engagement activities. Klara Jelinkova, Harvard's Vice President and University Chief Information Officer, said the breached IT systems did not store Social Security numbers, passwords, payment card information, or financial information. Although Harvard has not attributed the attack to a specific threat actor, the ShinyHunters extortion gang claimed responsibility and said it stole more than 1 million records containing identifiable information and donation data. After the university refused to pay a ransom to have the stolen data returned and destroyed, the group published a 1.1GB archive of documents on its dark web leak site in early February. A Harvard spokesperson could not confirm how many individuals had their information exposed when contacted at the time for further details. Have I Been Pwned subsequently analyzed the leaked data and confirmed on Tuesday that the breach affected 850,500 accounts, exposing names, email addresses, dates of birth, phone numbers, physical addresses, social media profiles, and other information. "The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students," the service said. The Harvard incident is part of a broader pattern affecting elite US universities. Two other Ivy League institutions, Princeton University and the University of Pennsylvania, disclosed data breaches in November 2025, with both confirming that attackers accessed donors' information. Separately, Harvard said in October 2025 that it was investigating a second data breach after the Clop ransomware gang claimed to have breached the university's systems using a zero-day vulnerability in Oracle E-Business Suite. Two months later, the University of Phoenix revealed that Clop had stolen data on nearly 3.5 million students, staff, and suppliers in August 2025 by exploiting the same Oracle flaw. ShinyHunters itself has faced increased law enforcement pressure, with recent arrests and reports of a suspected member detained abroad and cooperating with the FBI connected to the group's activities.