, front page
InitialReach
How we report

SecurityHarvard alumni and donor breachChanged

Harvard's 2025 breach of alumni and donor data covers about 851,000 email addresses, Have I Been Pwned's count of the leaked data shows

Have I Been Pwned (HIBP), a service that lets people check whether their email address is in data taken in a breach, added Harvard University on 3 November: 850,537 unique email addresses from the university's alumni and fundraising systems, with profile details of donors, alumni, parents and some faculty, staff and students. HIBP links the data to a “pay or leak” extortion attempt by ShinyHunters, a hacking group.

Harvard found on 18 November 2025 that an unauthorised party had got into systems used by its Alumni Affairs and Development office through a phishing phone call. Its incident page, last updated on 19 December 2025, gives no count, and the email Harvard sent to those affected on 22 November said it did not know precisely what information was accessed. A Harvard spokesperson could not say how many people were affected when BleepingComputer asked at the time.

Harvard's notice names email addresses, phone numbers, home and business addresses, event attendance, donation details and other biographical information. HIBP's list of what the data holds adds names, dates and places of birth, citizenship, ethnicity, gender, marital status, family members' names, education, employers, job titles and social media profiles. Harvard has not named who was behind the attack, and its page does not mention the leaked data.

Email addresses in the leaked data, by Have I Been Pwned's count

Before: Not given by HarvardNow: 850,537

What changed

Before Recent cybersecurity incident information and FAQ, as last updated on 19 December 2025 (Internet Archive copy of 3 November 2026), 19 December 2025Now Harvard Data Breach, 3 November 2026

  1. Email addresses

    Before

    No count from Harvard, which said it did not know precisely what was accessed

    Now

    850,537 unique addresses in the leaked data, by HIBP's count

  2. Kinds of information

    Before

    Email addresses, phone numbers, home and business addresses, event attendance, donation details, and other biographical information for fundraising and alumni engagement

    Now

    Also names, dates and places of birth, citizenship, ethnicity, gender, marital status, family members' names, education, employers, job titles, occupations, salutations and social media profiles, by HIBP's list

  3. Who was behind it

    Before

    Not said: a phone-based phishing attack

    Now

    Linked by HIBP to a ShinyHunters “pay or leak” extortion attempt; Harvard has named no one

  4. Published data

    Before

    None mentioned by Harvard

    Now

    An archive posted by ShinyHunters in early February 2026, after Harvard refused to pay, BleepingComputer reports

What stayed the same

  • Harvard found the unauthorised access on 18 November 2025, removed it at once, and says it has no evidence of further unauthorised access.
  • No Social Security numbers, passwords, payment card information or financial account numbers: Harvard says the systems do not generally hold them, and HIBP lists none of them.
  • Whose data: alumni and their spouses, partners and widows or widowers, donors, parents of current and former students, and some current students, faculty and staff, in Harvard's list; HIBP's description names the same groups.

What we don't know yet

  • How many people are affected. HIBP counts email addresses, a person may have several, and Harvard has given no count of people.
  • Whether Harvard confirms that the leaked data came from its systems. Its page does not mention the leak or HIBP's count.
  • Whether Harvard will notify people one by one. Its page says it will “assess if specific notifications are needed”.

The documents

For people in the field Identifiers, citations and the trade's shorthand, from the documents
HIBP record
Breach “Harvard”: breach date 18 November 2025, added 3 November 2026 at 07:24 UTC, 850,537 accounts. Data classes: charitable donations, citizenship statuses, dates of birth, education levels, email addresses, employers, ethnicities, family members' names, genders, job titles, marital statuses, names, occupations, phone numbers, physical addresses, places of birth, salutations, social media profiles.
The claim and the leak
Per BleepingComputer: ShinyHunters claimed over 1 million records with identifiable information and donation data, and posted a 1.1 GB archive of documents on its leak site in early February 2026. HIBP's count is of unique email addresses in that data.
Timeline
18 November 2025, Harvard finds the access; 22 November, it emails those with an email address in the systems and publishes its incident page; 19 December, the page's last update; early February 2026, the archive posted; 3 November 2026, HIBP adds the breach.