Short answer
Harvard said it found a breach of its Alumni Affairs and Development databases on 18 November 2025, caused by a phone-based phishing attack. On 3 November 2026 Have I Been Pwned added data tied to about 850,500 email addresses from the incident, which it links to a ShinyHunters pay-or-leak attempt.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Harvard University |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Higher education |
| Country | United States |
| Detected | 2025-11-18 |
| Disclosed | 2025-11-22 |
| People or records affected | About 850,500 unique email addresses, per Have I Been Pwned |
What data was exposed
- Names, email addresses, phone numbers and home and business addresses
- Donation details and event attendance records
- Biographical and profile data such as dates of birth, employers, job titles, family members' names and social media profiles (per Have I Been Pwned)
- Harvard says Social Security numbers, passwords, payment card and financial information were not stored in the affected systems
What happened
Harvard University announced on 22 November 2025 that an unauthorized party had breached databases used by Alumni Affairs and Development. Harvard Magazine reported that the entry point was a phone-based phishing attack and that Harvard discovered the breach on 18 November. Harvard said it removed the attacker’s access, brought in outside cybersecurity experts and contacted law enforcement.
What the data contains
Harvard listed email addresses, phone numbers, home and business addresses, event attendance, donation details and other biographical information about fundraising and alumni engagement. It said the systems did not store Social Security numbers, passwords, payment card details or financial account numbers.
On 3 November 2026, Have I Been Pwned added the incident, covering about 850,500 unique email addresses. Its entry lists a much wider set of profile fields: dates of birth, employers, job titles, family members’ names, marital status, places of birth and social media profiles, among others. It describes profiles of donors, alumni and parents, plus some faculty, staff and students. Harvard has not confirmed the HIBP figures, and it did not give a headcount when BleepingComputer asked earlier.
The extortion claim
BleepingComputer reports that the ShinyHunters extortion gang claimed the attack, said it had over one million records, and posted a 1.1GB archive on its leak site in early February 2026 after Harvard declined to pay. That is the group’s claim, relayed by BleepingComputer, and Harvard has not named an attacker. Princeton and the University of Pennsylvania disclosed similar donor-data breaches in November 2025, per BleepingComputer.
Why this data is useful to scammers
Donation history, class year and family names let a scammer write a message that sounds like a real fundraiser or alumni officer. The original breach began with voice phishing, so calls that claim to be from Harvard IT or the development office deserve particular caution.
What to do
Check your address on Have I Been Pwned. If you get a call or email about a gift, an account or a security problem, hang up and use a number from harvard.edu. Read our data breach checklist, and for donation pitches see our guide to charity scams and phishing messages.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake donation, pledge or reunion requests that quote real giving history or event attendance.
- Phone calls or emails posing as Harvard staff, IT or the alumni office, a pattern that began with the original vishing attack.
- Targeted phishing to parents, alumni and donors using family names, employers and addresses.
What to do if you are affected
- 01Search your email address on Have I Been Pwned to see whether it appears in the Harvard entry.
- 02Treat unexpected calls or emails from 'Harvard' about gifts, accounts or IT as suspect and call back using a number from harvard.edu.
- 03Never share one-time codes or approve sign-in prompts for anyone who contacts you first.
- 04Use unique passwords and turn on multi-factor authentication for email and accounts that use the exposed address.
- 05Pay donations only through links you type or bookmark yourself.
Frequently asked questions
Was my Social Security number or password exposed?
Harvard said the affected systems did not store Social Security numbers, passwords, payment card information or financial account numbers. Have I Been Pwned's data classes list profile and contact details instead.
Who was affected?
Harvard Magazine reported that alumni and their spouses or partners, donors, parents of current and former students, some current students and some faculty and staff may have been affected. Have I Been Pwned counts about 850,500 unique email addresses.
Who is behind the attack?
Harvard has not attributed the attack. The ShinyHunters extortion group claimed it, and BleepingComputer reports it leaked a 1.1GB archive in early February 2026 after Harvard did not pay. Those are the group's claims and BleepingComputer's account.
Why is this news again in November 2026?
Have I Been Pwned added the leaked data to its service on 3 November 2026, which let people search for their own addresses and gave a count of affected accounts. Harvard had not given a figure earlier.
Sources
- Harvard University data breach exposed info of 851,000 accounts, BleepingComputer, 2026-11-03
- Harvard Alumni Affairs Databases Breached, Harvard Magazine, 2025-11-25
- Harvard breach entry, Have I Been Pwned, 2026-11-03
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.