Harvard Alumni Breach Hit 851,000 Email Addresses
Breach notification service Have I Been Pwned has counted the accounts in data stolen from Harvard's alumni and fundraising systems. The leak followed a refused ransom demand.
Harvard could not say at the time how many people were hit by the theft of its alumni and fundraising data. An outside count now exists: on Tuesday, Have I Been Pwned confirmed that the leaked files cover 850,500 accounts.
Who did the counting
Have I Been Pwned is a breach notification service. People use it to check whether their email address turns up in leaked data. Its operators took the archive that criminals had published and analysed it themselves.
They found 851k unique email addresses tied to the university's alumni and fundraising systems. Their entry says the data held "extensive profile information for donors, alumni, parents and some faculty, staff and students."
The university had given no figure earlier. When BleepingComputer asked at the time, a Harvard spokesperson could not say how many individuals were exposed.
A refused ransom and a leak
Harvard discovered the intrusion on November 18, 2025. Attackers had reached the systems of its Alumni Affairs and Development office.
The university has not blamed any group. The ShinyHunters extortion gang did claim the attack. It said it had stolen over 1 million records with identifiable information and donation data.
Harvard would not pay. The gang then put a 1.1GB archive of documents on its dark web leak site in early February.
What the records contain
Harvard lists email addresses, telephone numbers, and home and business addresses. Event attendance records, donation details and biographical information about fundraising and alumni engagement were taken as well. Students, alumni, donors, staff and faculty were all affected.
Klara Jelinkova, Harvard's vice president and chief information officer, said the affected systems held no Social Security numbers, passwords, or card and financial data.
Have I Been Pwned adds names, dates of birth and social media profiles to the list of exposed fields.
Other incidents around the same time
This was not the only breach claim against Harvard. In October 2025 it told BleepingComputer it was investigating another one. The Clop ransomware gang said it had broken in through a zero-day vulnerability in Oracle E-Business Suite.
The University of Phoenix later said Clop used the same Oracle flaw. It reported that data on nearly 3.5 million students, staff and suppliers was stolen in August 2025.
Two more Ivy League schools, Princeton University and the University of Pennsylvania, disclosed breaches in November 2025. Both confirmed that donors' information was accessed.
Our View
Donor and alumni records are useful to scammers. Names, past gifts and events attended let a fraudster write a message that looks like it comes from the university. Harvard says passwords and financial data were not in these systems, so the likelier harm is targeted deception.
It is unclear whether Harvard will notify each of the affected addresses.
Source: BleepingComputer