Harvard University's Alumni Affairs and Development systems were breached in November 2025, and the stolen data is tied to more than 850,000 unique email addresses, according to the breach notification service Have I Been Pwned. The university is a private Ivy League institution with over 20,000 faculty and staff, over 24,500 undergraduate and graduate students, and more than 400,000 alumni worldwide.
Harvard found on November 18, 2025, that attackers had reached personal information belonging to students, alumni, donors, staff and faculty. The exposed data included email addresses, telephone numbers, home and business addresses, event attendance records, donation details and biographical information related to university fundraising and alumni engagement activities.
Klara Jelinkova, Harvard's Vice President and University Chief Information Officer, said the compromised IT systems did not store Social Security numbers, passwords, payment card information or financial information. Harvard has not tied the attack to a specific hacking group or threat actor.
The ShinyHunters extortion gang claimed responsibility, saying it stole over 1 million records containing identifiable information and donation data from the university's systems. After Harvard declined to pay a ransom for the return and destruction of the stolen data, the cybercriminals leaked a 1.1GB archive of documents on their dark web leak site in early February.
At the time, a Harvard spokesperson could not say how many individuals had their information exposed. Have I Been Pwned analyzed the leaked data and confirmed on Tuesday that the breach exposed the data of 850,500 accounts, including names, email addresses, dates of birth, phone numbers, physical addresses and social media profiles, among other information. The service said the data contained 851,000 unique email addresses linked to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students.
Two other Ivy League schools, Princeton University and the University of Pennsylvania, disclosed data breaches in November 2025, both confirming that attackers accessed donors' information. In October 2025, Harvard also said it was investigating a second data breach after the Clop ransomware gang claimed it had breached the university's systems using an Oracle E-Business Suite zero-day vulnerability. Two months later, the University of Phoenix disclosed that Clop used the same Oracle EBS flaw to steal data from nearly 3.5 million of its students, staff and suppliers in August 2025.
More cybersecurity news from TechManNews.
