Harvard breach: 850,000 accounts exposed in leaked data

The scale of the November 2025 cyberattack on Harvard University has come into focus. Have I Been Pwned (HIBP), which analyzed the leaked archive, said data tied to roughly 850,500 accounts was taken. Hundreds of thousands of email addresses have appeared in breach-tracking databases and dark web archives, and the same breach also exposed extensive profile information for some individuals.

The extortion group ShinyHunters, which claimed the attack, published the data after negotiations with the university failed. How many people were affected was unclear at the time; analysis of the archive has now produced a concrete figure.

How the attack unfolded

In late November 2025, Harvard confirmed that its Alumni Affairs and Development systems had been compromised. The attack was carried out through voice phishing, known as vishing. The affected systems held information on alumni, donors, some faculty and administrative staff, and some current students, as well as data on their spouses, partners and parents. The university said both former and current students were affected.

According to Harvard, the stolen data included email addresses, phone numbers, home and business addresses, event attendance records, donation details, alumni relationships and biographical information related to fundraising activities. Social Security numbers, passwords, payment card details and other financial data were not affected.

Harvard did not name the attackers at the time, but ShinyHunters soon claimed responsibility.

What the leaked data contains

In a new post on a dark web forum, ShinyHunters had claimed to have stolen more than a million personal data records along with donation data. When negotiations with the university went nowhere, the group released more than 1.1 GB of documents in early February. Nobody knew exactly how many people were affected at that point.

HIBP, after a thorough analysis of the leaked archive, said 850,500 accounts were impacted. According to the site, the exposed information includes names, email addresses, dates of birth, phone numbers, postal addresses and social media profiles.

In HIBP's words, the data contains 851,000 unique email addresses linked to the university's alumni and donor systems. The archive also holds detailed profile information for donors, alumni, parents, and some faculty, administrative staff and students.

A wave of attacks on universities

Harvard was the third university ShinyHunters targeted in a short span, following similar incidents at Princeton University and the University of Pennsylvania. When the group claimed the attack on Penn in early November 2025, it said it had stolen data on about 1.2 million students, alumni and donors.

An unidentified attacker said they had gained full access to a university employee's PennKey single sign-on account. Through it, they reached Penn's VPN, Salesforce data, the Qlik analytics platform, the SAP business intelligence system and SharePoint files. Penn said the attack was carried out through social engineering. Although multifactor authentication was mandatory for most employees, some senior executives were reportedly allowed to skip that step.

Penn initially described emails attributed to the attackers as clearly fake, then reversed course and confirmed the incident. The university said it quickly locked down its systems and prevented continued unauthorized access, but not before some information was taken. Penn's investigation into exactly what was compromised was still ongoing.

The string of incidents underscores that social engineering attacks on universities' alumni and fundraising systems remain a persistent risk.