Harvard’s November 2025 data breach now has a clearer footprint: approximately 851,000 unique email addresses appear in records cataloged by Have I Been Pwned (HIBP).
HIBP added the dataset on Nov. 3, 2026, nearly a year after the intrusion into Harvard's Alumni Affairs and Development systems. While the 851,000 figure represents unique email addresses rather than a confirmed number of affected individuals, the records also contain donation histories and personal details linked to alumni, donors, parents, and some students and employees. Such information could help attackers impersonate university representatives or craft more convincing phishing messages.
HIBP identifies detailed donor and alumni information
HIBP's breach entry lists about 850,500 unique addresses and data categories including names, phone numbers, physical addresses, birth dates, employers, donation information, citizenship statuses, ethnicities, and family members’ names. Not every record necessarily contains every category.
Harvard said it discovered the intrusion on Nov. 18, 2025, after a phone-based phishing attack. In its incident notice, the university said it had removed unauthorized access and found "no evidence of further unauthorized access." It also said the affected systems did not generally contain passwords, Social Security numbers, payment-card data, or bank account information.
ShinyHunters claimed responsibility for the earlier leak
BleepingComputer reported that ShinyHunters claimed responsibility for the breach and published a 1.1GB archive in February 2026, alleging it contained more than one million records. TechCrunch reported verifying some of the published information. However, Harvard has not publicly attributed the attack to the group, and ShinyHunters' claimed record count should not be confused with HIBP's tally of unique email addresses.
In its Nov. 22, 2025, notification email, Harvard said it had not determined precisely what information was accessed. HIBP’s November 2026 listing identifies the dataset’s scale and reported data categories, but does not establish which details were exposed for each person. The listing concerns the November 2025 breach.
ShinyHunters was also linked to a separate May 2026 attack involving Instructure Canvas that disrupted university login portals, including at Harvard. The incident involved a different platform, with no established connection to the university's alumni and donor data breach.
Detailed profiles put alumni and donor communications at risk
A scammer who knows someone's employer, past donations, or family connections could send a plausible message about an alumni event, a pledge, or a request to update contact details. The cited sources do not report confirmed phishing campaigns using this dataset. Still, the information could make fraudulent emails and calls harder to distinguish from legitimate university outreach.
For people and organizations connected to Harvard, the next steps are specific:
- Alumni and donors: Check relevant email addresses at Have I Been Pwned. A result listing the Harvard breach means the address appeared in that dataset; it does not prove a password was stolen. Treat unexpected fundraising, account-verification, or payment requests as suspicious, and verify them through Harvard contact details found independently.
- University IT teams: Review who can access and export alumni records, restrict bulk downloads, and strengthen authentication for staff handling donor databases. Train help desks to challenge callers seeking access or account changes, especially because the original intrusion involved phone-based phishing.
- Advancement and support teams: Prepare to answer questions through verified channels. Use consistent guidance so attackers cannot exploit confusion by posing as university support, and encourage recipients to report suspicious messages referring to private biographical details.
Unlike a password, a donor’s history, family members’ names, and professional connections cannot simply be reset after exposure. Attackers could use those details to make fraudulent fundraising or payment requests appear credible. A message referencing a genuine donation or personal connection should therefore be treated as a claim to verify, rather than proof of identity.
Advancement and support teams should establish a clear process for verifying requests to change payment details or donor account information. Staff should confirm unusual requests using contact details already held in trusted records, rather than numbers or links supplied in an incoming message. Help desks should also avoid using exposed biographical details as the sole basis for password resets or account recovery.
Universities should review how long they retain donor and alumni information, who needs access, and whether unusual exports generate alerts. The ransomware attack that closed University of Mississippi Medical Center clinics illustrates a different consequence of cyber incidents: operational disruption. Harvard’s case highlights why containing an intrusion must also be followed by sustained guidance for people whose exposed information could support future impersonation attempts.
Read more: Sensitive university records can also be exposed outside production systems, as a University of Copenhagen breach affecting approximately 525,000 people demonstrates.