Harvard University data breach exposed info of 851,000 accounts
Hackers who breached Harvard University’s Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned.
Hackers who breached Harvard University’s Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned.
Harvard is a private Ivy League research university with over 20,000 faculty and staff, over 24,500 undergraduate and graduate students, and more than 400,000 alumni worldwide.
As the university discovered on November 18, 2025, the attackers gained access to the personal information of students, alumni, donors, staff, and faculty members, including email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and “biographical information pertaining to University fundraising and alumni engagement activities.”
However, Klara Jelinkova, Harvard’s Vice President and University Chief Information Officer (CIO), said the breached IT systems didn’t store Social Security numbers, passwords, payment card information, or financial information.
Although Harvard has not attributed the attack to a specific hacking group or threat actor, the ShinyHunters extortion gang claimed responsibility and said it stole over 1 million records containing identifiable information and donation data after breaching the university’s systems.
The cybercriminals then leaked a 1.1GB archive of documents on their dark web leak site in early February after Harvard refused to pay a ransom to have the stolen data returned and destroyed.
Harvard University on ShinyHunters leak site (BleepingComputer)
While a Harvard spokesperson could not share how many individuals had their information exposed when BleepingComputer reached out at the time for more details, Have I Been Pwned analyzed the data leaked by the cybercrime gang and confirmed on Tuesday that the breach exposed the data of 850,500 accounts, including names, email addresses, dates of birth, phone numbers, physical addresses, social media profiles, and more
“The data contained 851k unique email addresses relating to the university’s alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students,” it said.
Two other Ivy League schools, Princeton University and the University of Pennsylvania, disclosed data breaches in November 2025, both confirming that the attackers accessed donors’ information.
In October 2025, Harvard also told BleepingComputer that it was investigating a second data breach after the Clop ransomware gang claimed that it had breached the university’s systems using an Oracle E-Business Suite (EBS) zero-day vulnerability.
Two months later, the University of Phoenix (UoPX) joined the list of US universities breached by Clop using the same Oracle EBS flaw and revealed that the ransomware gang stole data from nearly 3.5 million UoPX students, staff, and suppliers in August 2025.
Uncover email threats your existing defenses may miss.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
