Harvard breach exposed data linked to 851,000 email addresses

A data breach at Harvard University exposed information linked to 851,000 unique email addresses in its alumni and fundraising systems, according to breach notification service Have I Been Pwned (HIBP).

HIBP said the leaked data included names, email addresses, dates of birth, phone numbers, physical addresses, social media profiles and other profile information about donors, alumni, parents, and some faculty, staff and students. Harvard discovered the intrusion on November 18, 2025. The attackers had accessed systems belonging to Alumni Affairs and Development.

Harvard Vice President and Chief Information Officer Klara Jelinkova said the systems did not store Social Security numbers, passwords, payment card information or financial information. Harvard has not attributed the incident to a specific threat actor.

The ShinyHunters extortion gang claimed responsibility, saying it stole more than 1 million records. In early February, it published a 1.1GB archive on its leak site after Harvard refused to pay a ransom, according to the report.

HIBP’s count of 851,000 unique email addresses differs from its analysis finding data for 850,500 accounts. The report also notes that Princeton University and the University of Pennsylvania disclosed donor data breaches in November 2025.