Science & Tech · Cybersecurity · 4 hrs ago
Harvard breach exposed data linked to 851,000 email addresses
A phone-based phishing attack breached Harvard's alumni and fundraising systems in November 2025.
The affected systems held information about donors, alumni, parents, and some students, faculty, and staff.
Have I Been Pwned found about 851,000 unique email addresses in the leaked files.
The files included names, contact details, dates of birth, social media profiles, and donation information, though not every detail applied to every person.
Harvard said the breached systems did not store Social Security numbers, passwords, payment card details, or financial information.
ShinyHunters claimed responsibility and said it stole more than one million records; Harvard has not publicly attributed the attack to a specific group.
The gang later published a 1.1GB archive after Harvard refused to pay a ransom, and the exposed data could put affected people at risk of unwanted contact or identity misuse.
Have I Been Pwned says data from Harvard University’s 2025 breach was linked to 851,000 unique email addresses.
The breach involved Harvard’s Alumni Affairs and Development systems and affected data linked to alumni, donors, parents, faculty, staff and students.
The stolen files included personal and donation information, though the data points varied by person.
ShinyHunters claimed responsibility and said it stole more than 1 million records.
Harvard’s vice president and chief information officer said the breached systems did not store Social Security numbers, passwords, payment card information or financial information.
- Who
- People linked to 851,000 unique email addresses, including alumni, donors, parents, faculty, staff and students.
- What
- Data was stolen from Harvard’s Alumni Affairs and Development systems.
- When
- Harvard discovered the breach on November 18, 2025. Have I Been Pwned reported the email-address total on November 3, 2026.
- Where
- Harvard University’s Alumni Affairs and Development systems.
- Why
- The sources do not state the attackers’ motive. ShinyHunters claimed responsibility and sought a ransom, according to BleepingComputer.
This story does not have two clearly opposing sides.
Harvard discovered that attackers had accessed its Alumni Affairs and Development systems.
ShinyHunters leaked an archive of documents after Harvard refused to pay a ransom, according to BleepingComputer.
Have I Been Pwned reported that the leaked data contained 851,000 unique email addresses.
- Unique email addresses
- 851,000, according to Have I Been Pwned
- Affected systems
- Alumni Affairs and Development
- Discovery date
- November 18, 2025
- Group claiming responsibility
- ShinyHunters
- Leaked archive size
- 1.1GB
3 sources
What people are saying
The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students
phone-based phishing