Hackers who breached Harvard University’s alumni affairs and development systems in November 2025 stole data associated with more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. The exposed information includes contact details and extensive profiles linked to alumni, donors, parents, faculty, staff, and students, although Harvard says the compromised systems did not contain Social Security numbers, passwords, payment card information, or financial information.
Harvard breach exposed alumni and fundraising data
Harvard University is a private Ivy League research university with more than 20,000 faculty members, more than 24,500 undergraduate and graduate students, and more than 400,000 alumni worldwide.
The university discovered the intrusion on November 18, 2025. The attackers accessed personal information belonging to students, alumni, donors, staff, and faculty, including email addresses, phone numbers, home and work addresses, event attendance records, donation details, and “biographical information regarding the University’s fundraising and alumni engagement activities.”
However, Klara Jelinková, Harvard University’s vice president and chief information officer (CIO), said the affected IT systems did not store Social Security numbers, passwords, payment card information, or financial information.
Harvard said the attack was not attributed to a particular hacking group or threat actor. The extortion group Shiny Hunters, however, claimed involvement, saying it had infiltrated the university’s systems and stolen more than 1 million records containing personally identifiable information and donation data.
After Harvard refused to pay a ransom in exchange for returning and destroying the stolen information, cybercriminals leaked a 1.1GB archive of documents to a dark web leak site in early February.
Have I Been Pwned confirms 850,500 affected accounts
When BleepingComputer contacted Harvard for additional details, a university spokesperson could not say how many individuals had been affected. Have I Been Pwned later analyzed data leaked by a cybercriminal organization and confirmed the breach on Tuesday.
Have I Been Pwned lists 850,500 affected accounts and says the leaked data includes names, email addresses, dates of birth, phone numbers, addresses, social media profiles, and other information.
“The data included 851,000 unique email addresses related to the university’s alumni and fundraising systems, as well as extensive profile information about donors, alumni, parents, some faculty, staff, and students.”
Other universities also disclosed breaches
Two other Ivy League schools, Princeton University and the University of Pennsylvania, disclosed data breaches in November 2025. Both universities confirmed that attackers had accessed donor information.
Harvard also told BleepingComputer in October 2025 that it was investigating a second data breach. The Clop ransomware group had claimed to exploit a zero-day vulnerability in Oracle E-Business Suite (EBS) to infiltrate the university’s systems.
Two months later, the University of Phoenix (UoPX) joined the list of US universities compromised by Clop using the same Oracle EBS flaw. The university said the ransomware group stole data belonging to approximately 3.5 million UoPX students, staff, and suppliers in August 2025.
Source: www.bleepingcomputer.com