A breach of Harvard University's alumni and fundraising systems exposed data linked to more than 850,000 accounts, according to the breach notification service Have I Been Pwned, which analysed files the ShinyHunters extortion gang published after the university refused to pay a ransom.
Have I Been Pwned said on Tuesday that the breach exposed the data of 850,500 accounts, including names, email addresses, dates of birth, phone numbers, physical addresses and social media profiles. "The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students," it said.
Harvard, a private Ivy League research university with more than 400,000 alumni worldwide, discovered on November 18, 2025 that attackers had gained access to the personal information of students, alumni, donors, staff and faculty. The data included email addresses, telephone numbers, home and business addresses, event attendance records, donation details and what the university described as "biographical information pertaining to University fundraising and alumni engagement activities."
Klara Jelinkova, Harvard's Vice President and University Chief Information Officer, said the breached IT systems did not store Social Security numbers, passwords, payment card information or financial information.
ShinyHunters claimed responsibility for the intrusion, saying it stole more than 1 million records containing identifiable information and donation data. The gang then leaked a 1.1GB archive of documents on its dark web leak site in early February, after Harvard refused to pay a ransom to have the stolen data returned and destroyed. Harvard has not attributed the attack to a specific hacking group, and a university spokesperson could not share how many individuals had their information exposed when BleepingComputer asked at the time.
Harvard was one of several US universities dealing with donor-data breaches. Princeton University and the University of Pennsylvania both disclosed breaches in November 2025 and confirmed that attackers had accessed donors' information. In October 2025, Harvard said it was investigating a second breach after the Clop ransomware gang claimed it had broken into the university's systems using an Oracle E-Business Suite zero-day vulnerability. The University of Phoenix later joined the list of US universities breached by Clop using the same flaw, and revealed that the ransomware gang stole data from nearly 3.5 million of its students, staff and suppliers.
Analysis
Why This Matters
- The confirmed figure gives the first public measure of a breach Harvard disclosed a year ago, and shows how much donor and alumni data extortion gangs can take from a single university.
- Alumni and donor databases hold combinations of contact details, giving history and biographical notes that are hard to change after a leak, unlike a password.
- Affected people should expect targeted phishing that uses real donation and event history to appear convincing.
Background
Harvard is one of the oldest and wealthiest universities in the United States, and its fundraising operation maintains detailed records on alumni, parents and donors going back decades. Universities have become recurring targets for extortion crews that take data rather than lock systems, then threaten to publish it unless paid. Harvard's case fits that pattern: the gang published an archive after the university declined to pay.
Key Perspectives
Klara Jelinkova, Harvard's Vice President and University Chief Information Officer: said the breached IT systems did not store Social Security numbers, passwords, payment card information or financial information.
ShinyHunters: claimed responsibility for the breach and said it stole more than 1 million records containing identifiable information and donation data.
What to Watch
- Whether Harvard notifies affected alumni, donors and staff directly, and what figure it gives them.
- Whether the university reaches a conclusion on the separate Clop claim it said in October 2025 it was investigating.
- Whether Have I Been Pwned's count is revised as more of the leaked archive is analysed.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe breach exposed data linked to about 850,000 accounts, according to Have I Been Pwned.BleepingComputer: “Have I Been Pwned analyzed the data leaked by the cybercrime gang and confirmed on Tuesday that the breach exposed the data of 850,500 accounts”
- SupportedShinyHunters claimed responsibility for the intrusion.BleepingComputer: “the ShinyHunters extortion gang claimed responsibility”
- SupportedShinyHunters leaked a 1.1GB archive after Harvard refused to pay a ransom.BleepingComputer: “The cybercriminals then leaked a 1.1GB archive of documents on their dark web leak site in early February after Harvard refused to pay a ransom”
- SupportedHarvard said the breached systems held no Social Security numbers or payment data.BleepingComputer: “Klara Jelinkova, Harvard's Vice President and University Chief Information Officer (CIO), said the breached IT systems didn't store Social Security numbers, passwords, payment card information, or financial information.”
- SupportedHarvard's alumni and fundraising systems were breached, and Have I Been Pwned said the data was linked to more than 850,000 unique email addresses.BleepingComputer: “Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned.”
- SupportedHave I Been Pwned said the breach exposed data from 850,500 accounts, including names, email addresses, dates of birth, phone numbers, physical addresses and social media profiles.BleepingComputer: “the breach exposed the data of 850,500 accounts, including names, email addresses, dates of birth, phone numbers, physical addresses, social media profiles, and more”
- SupportedHave I Been Pwned said the data contained 851,000 unique email addresses and profile information for donors, alumni, parents, and some faculty, staff and students.BleepingComputer: “"The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students," it said.”
- SupportedHarvard discovered on November 18, 2025, that attackers had accessed personal information belonging to students, alumni, donors, staff and faculty.BleepingComputer: “As the university discovered on November 18, 2025 , the attackers gained access to the personal information of students, alumni, donors, staff, and faculty members”
- SupportedThe exposed data included contact details, addresses, event attendance records, donation details and biographical information related to fundraising and alumni engagement.BleepingComputer: “including email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and "biographical information pertaining to University fundraising and alumni engagement activities."”
- SupportedKlara Jelinkova, Harvard's Vice President and University Chief Information Officer, said the breached systems did not store Social Security numbers, passwords, payment card information or financial information.BleepingComputer: “Klara Jelinkova, Harvard's Vice President and University Chief Information Officer (CIO), said the breached IT systems didn't store Social Security numbers, passwords, payment card information, or financial information.”
- SupportedShinyHunters said it stole more than 1 million records containing identifiable information and donation data.BleepingComputer: “the ShinyHunters extortion gang claimed responsibility and said it stole over 1 million records containing identifiable information and donation data”
- SupportedHarvard has not attributed the attack to a specific hacking group.BleepingComputer: “Although Harvard has not attributed the attack to a specific hacking group or threat actor”
