Harvard Data Breach Exposed 850,500 Unique Email Addresses, Report

The hackers behind the Harvard University alumni and fundraising systems data breach in November 2025 stole data tied to about 851,000 email addresses.

Have I Been Pwned reported the breach details on Nov. 3. According to the site, the breach affected 850,500 addresses. Harvard has not said publicly how many people the attack touched.

Notably, there are over 400,000 people worldwide who graduated from Harvard. The school also has donors, parents, faculty and staff. All of them can show up in these files.

How the Attackers Got Inside Harvard University’s System

Harvard found the problem on Nov. 18, 2025. Someone had reached the systems that Alumni Affairs and Development uses. The university says a phone-based phishing attack made it possible. In this kind of attack, a caller poses as a trusted person and tricks an employee into handing over access.

Harvard shut the intruder out right away. It then hired outside security experts and told law enforcement. On Nov. 22, the university emailed people whose records sat in the hacked systems. It urged them to watch for fake messages that claim to come from Harvard.

When hackers broke in, they told TechCrunch they were running a bigger campaign. They went after single sign-on logins. This basically means staff could use one password for a bunch of different tools.

What Information did the Hackers Take?

Harvard’s statement included a long list of what got exposed. There’s email addresses, phone numbers, home and work addresses, event attendance and donation history. Also, it mentioned biographical notes tied to fundraising and alumni activities.

HIBP’s review of the leaked files shows more. There’s more. The leak also covers birth dates, family members’ names, and marital status. Plus, there’s also data on employers, job titles, even ethnicity, citizenship, and places of birth in some cases. Others point to social media profiles.

The victims are not only alumni. HIBP says donors, parents and some faculty, staff and students appear in the files too.

But here’s one bit of good news from Harvard. They say their systems didn’t store Social Security numbers, passwords, credit card details, or other financial data. That means people aren’t facing a high risk of someone draining their accounts.  However, the personal details give scammers plenty to work with.

ShinyHunters Claimed Responsibility for the Attack

Harvard has not named a group. The gang ShinyHunters says it did the job. It steals data and then demands money to keep it private.

The hackers say Harvard refused to pay. As a result, the group posted the stolen files on its leak site on Feb. 4. The group claimed more than 1 million Harvard records, TechCrunch said. BleepingComputer cited a 1.1GB archive. TechCrunch checked part of the leaked data against alumni and public records. It matched what Harvard said was stolen.

You might notice the numbers don’t always match across reports. Here’s why: having more records than people isn’t surprising—one person’s info can show up multiple times. HIBP just counts unique email addresses, so their total is probably the most reliable. Other places report higher or lower numbers. But it pays to take those with a grain of salt.

Meanwhile, the legal fallout started early. Bloomberg Law reported that one person sued Harvard in a proposed class action in late November 2025. The suit says the school failed to protect its alumni database.

A Pattern Across the Ivy League Schools

Harvard was not alone. The University of Pennsylvania had a similar break-in in late October 2025. HIBP later logged about 624,000 unique email addresses from that case. Also, Princeton said hackers got into its donor and alumni database on Nov. 10, 2025. The University of Copenhagen in Denmark also confirmed a second cyberattack following a data breach that affected 525,000 people.

Penn’s attackers also sent offensive mass emails from official university addresses. Even so, TechCrunch noted that ShinyHunters has no known political motives.

Separately, Harvard dealt with another case in October 2025. The Clop extortion gang claimed it stole data through a flaw in Oracle’s E-Business Suite software. Harvard said that incident hit a small administrative unit. It is a separate case from the alumni breach.

What the Affected People ShDold do

Start by heading over to haveibeenpwned.com and type in your email address. See if your info’s out there.  The site shows whether it appears in the Harvard leak. Beware of unexpected text messages, calls, or emails. Don’t give your password or other personal info to anyone over an unsolicited phone call. Rather, call a number you trust to verify first.

Make sure to use two-factor authentication for your bank account. It is best to use different passwords for different accounts. You can easily achieve this by using a password manager.

In case you are worried about identity theft, go for a credit freeze. It is free under federal law and takes only minutes. A credit freeze blocks thieves from opening accounts in your name.

Since these files contain things like birth dates and family names, you’re more likely to get personal scams. Someone might mention a donation or try to talk about an alumni event to sound convincing. Don’t panic, ask for specifics. And always double-check through Harvard’s official website before giving out your info.