Harvard’s Alumni Breach Gets a Number: 851,000 Email Addresses
Have I Been Pwned has added 851,000 email addresses from Harvard's November 2025 alumni and donor systems breach, data ShinyHunters leaked after Harvard refused to pay. No passwords, SSNs or payment data were in the systems.
A year after hackers got into Harvard’s fundraising systems, we now have a number: 851,000 unique email addresses. BleepingComputer reports that Have I Been Pwned has added the data from the November 2025 breach of Harvard’s Alumni Affairs and Development systems, after analysing an archive the ShinyHunters extortion gang leaked in February when the university refused to pay. Harvard itself has never said how many people were affected.
For defenders
What was taken: per Have I Been Pwned, names, email addresses, dates of birth, phone numbers, physical addresses and social media profiles, with extensive profile records for donors, alumni and parents and some faculty, staff and students. Harvard’s own notice listed home and business addresses, event attendance, donation details and biographical information used for fundraising.
What wasn’t: Harvard CIO Klara Jelinkova said the affected systems held no Social Security numbers, passwords, payment cards or financial account data.
Timeline and attribution: Harvard found the intrusion on Nov. 18, 2025. ShinyHunters claimed it and says it took more than 1 million records; Harvard hasn’t attributed the attack, and how the attackers got in hasn’t been disclosed. Princeton and the University of Pennsylvania disclosed donor and alumni breaches the same month. A separate October 2025 Harvard investigation tied to Clop’s claimed Oracle E-Business Suite campaign isn’t linked to this one in the reporting.
What it means for you
No passwords or bank details leaked, but a fundraising database is a scammer’s dream: it knows your name, address, birthday, how much you’ve given and which reunion you went to. Expect convincing “Harvard development office” calls and emails asking you to renew a pledge, confirm details or pay for an event. Because the data has been public since February, those messages may already be arriving.
Do this now
- Check your email at Have I Been Pwned to see whether you’re in this breach.
- If you give to Harvard, only donate through a link you type yourself or by calling a number from Harvard’s official site, never one in an unexpected email or text.
- Treat any message that quotes your past gifts or reunion year as a possible scam until you’ve confirmed it independently.
- Universities and nonprofits: lock down donor CRM access with phishing-resistant MFA, since Harvard, Princeton and Penn all disclosed donor and alumni breaches within weeks of each other.