Harvard breach hits 851,000 accounts, exposing donor profiles

What was actually stolen in the Harvard data breach

The breach-tracking site Have I Been Pwned (HIBP) has analysed the archive ShinyHunters dumped in February and put a number on it: 850,500 accounts, represented by 851,000 unique email addresses.

That figure is the first clear count of the victims. When Harvard confirmed the incident in late November 2025, it described a compromise of its Alumni Affairs and Development systems but did not say how many people were affected.

According to HIBP, the leaked records include names, email addresses, dates of birth, phone numbers, postal addresses and social media profiles. The archive also carries what HIBP calls "extensive profile information" for donors, alumni, parents and some faculty, staff and students.

Harvard's own notice said the data covered alumni, donors, some faculty and staff, some current students, and even spouses, partners and parents. Event attendance records and donation details were part of the haul. The university said Social Security numbers, passwords, payment card information and financial data were not exposed.

The stolen material is exactly the kind of information a fundraising office hoards: who gives, how much, which events they attend, and how to reach them. That makes it valuable for phishing and social engineering long after the headlines fade.

How ShinyHunters got in: a phone call, not a zero-day

The attack was a voice phishing campaign, not a software exploit. Someone convinced a person with access to Harvard's alumni systems to hand it over.

Harvard confirmed the vishing attack shortly after the November 2025 incident. ShinyHunters claimed responsibility, saying it stole more than a million records containing personally identifiable information and donation data. When negotiations broke down, the group leaked over 1.1GB of documents in early February 2026.

Harvard was the third university hit in a matter of weeks. Princeton and the University of Pennsylvania suffered similar breaches around the same time. In Penn's case, ShinyHunters claimed data on roughly 1.2 million students, alumni and donors, and an unnamed threat actor said the group gained full access to an employee's PennKey SSO account. Penn initially called the attacker's emails fake before confirming the incident.

Universities are attractive targets because they combine sprawling alumni databases, decentralised IT and a culture of open access. A single compromised account in a development office can expose decades of donor relationships. The pattern echoes other social-engineering breaches TechCortex has covered, such as the fake job interview that led to the $6.3B Binance heist, where a convincing conversation was enough to bypass technical controls.

What Harvard alumni and donors should do now

The exposed data is a ready-made script for phishing. Anyone in the archive should assume their name, email, phone number and giving history may be in criminal hands.

Harvard has not said it will offer identity protection services, and the absence of Social Security numbers lowers the risk of direct financial fraud. But the combination of birth dates, phone numbers and donor history is enough to craft convincing messages that appear to come from the university or a charity.

Watch for emails or calls that reference your graduation year, a past donation or an event you attended. Those details are now public on the dark web. Verify any request for money or credentials through a channel you initiate, not one supplied in the message.

HIBP has added the Harvard addresses to its database, so checking your email there will tell you whether you are in the leak. If you are, change any password you reused on a Harvard-related account, even though Harvard says passwords were not exposed.

• Check your email on Have I Been Pwned to confirm exposure.
• Treat unexpected Harvard or charity emails with suspicion, especially ones citing donor history.
• Enable multi-factor authentication on personal email and financial accounts.
• Report suspicious messages to Harvard's IT security team.

What it means for you

The breach affects anyone in Harvard's global alumni and donor network, including people in the US, UK and EU. Harvard has not announced any notification or credit monitoring programme for international alumni, and there is no indication the leaked data is limited to US residents.

If you have ever donated to Harvard or attended the university, your contact details may be in the archive regardless of where you live. Under GDPR, EU residents have the right to ask Harvard what data it holds on them, but enforcement across a US university is slow and uncertain.

Harvard's breach is now a number: 851,000 accounts, with enough personal detail to fuel phishing campaigns for years. The university escaped the worst categories of data, but the episode shows how a single phone call can undo layers of security at even the most prestigious institutions.