Harvard alumni and donor data breach: 851,000 email addresses, with birth dates, phone numbers and donations
Hackers got into Harvard's Alumni Affairs and Development systems in November 2025. Harvard says it found the breach and disclosed it on 18 November 2025, and that it did not pay the ransom demanded. The ShinyHunters gang then leaked a 1.1GB archive in early February 2026. Have I Been Pwned added it on 3 November 2026 and counts about 851,000 unique email addresses (its own page says 850,500). Besides names, email addresses, phone numbers and home and business addresses, HIBP lists dates of birth, places of birth, marital status, family members' names, employers, job titles, education levels, citizenship, ethnicity, social media profiles, event attendance and details of donations to the university. Harvard's chief information officer says the systems held no Social Security numbers, passwords, card numbers or financial information. Scammers can use the leaked personal and donation details to impersonate Harvard and request payments. Harvard also investigated a separate breach in October 2025, through an Oracle E-Business Suite flaw that the Clop gang used, so this is not the only way its data has been exposed.
Timeline
-
HARD publishes its alert, at Watch.
What to do
- Check every email address the family has used for Harvard (as a student, alumnus, donor, employee or event guest) at haveibeenpwned.com.
- Expect well-informed fake emails, texts and calls about donations, reunions, pledges and alumni directory updates, since the sender may know what was given and when.
- Confirm any request by calling Harvard on a number from its own website, and never pay a pledge or update details through a link you were sent.
- A caller who knows your birth date or your family's names has not shown who they are, so ask your bank and phone company to put a verbal password or PIN on the account.
- No password was taken, so nothing needs changing for this breach, but change any password you reused on a Harvard account.
Related
Situations
- Northflank, a platform-as-a-service, is the ninth developer platform this month to lose the keys customers stored with it Data breach, high, 22 Oct 2026
- Scribd breached: account details, and for some card details, of Scribd, Everand, SlideShare and Fable users Data breach, watch, 31 Oct 2026
- Florida student-aid breach may expose Social Security numbers among 4.9 million people Data breach, high, 6 Nov 2026
- Revolve payment-card breach may affect 1.5 million shoppers Data breach, high, 6 Nov 2026
- Every situation, in the Situation Room
Companies
- Oracle every Oracle flaw being used in attacks
References
- BleepingComputer (). “Harvard University data breach exposed info of 851,000 accounts”.
- Have I Been Pwned (). “Have I Been Pwned: Harvard”.
Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.