HARVARD DATA BREACH EXPOSES 850,500 ACCOUNTS

Have I Been Pwned says its analysis of stolen Harvard University data identified 850,500 compromised accounts following a November 2025 breach. Harvard said attackers accessed its Alumni Affairs and Development systems through voice phishing, a form of social engineering conducted by telephone. The university said it discovered the breach on 18 November, with information concerning alumni, donors, students, faculty and staff among the affected records. Have I Been Pwned said the archive contained “extensive profile information” and identified names, email addresses, dates of birth, telephone numbers, postal addresses and social media profiles.

Harvard said the compromised systems also contained event attendance records, donation details and biographical information relating to fundraising and alumni engagement. The university said records included information about spouses, partners and parents, alongside current and former students. Klara Jelinkova, Harvard’s vice-president and chief information officer, said the systems did not store Social Security numbers, passwords, payment card information or financial information. ShinyHunters claimed responsibility and said it stole more than one million records containing personal information and donation data; Harvard has not attributed the attack to a particular group.

ShinyHunters published the stolen documents on its dark web leak site in early February after ransom negotiations broke down. Accounts place the archive’s size at 1.1GB or more than 1.1GB. A Harvard spokesperson did not provide a total number of affected individuals when asked, while Have I Been Pwned’s tally counts accounts. Princeton University and the University of Pennsylvania also disclosed breaches in November 2025, with both universities confirming that attackers accessed donor information.