Have I Been Pwned lists Harvard alumni breach data for 850,500 accounts

850,500 accounts were exposed in the Harvard alumni breach, Have I Been Pwned confirmed on Nov. 3, 2026, after intruders entered Harvard University’s Alumni Affairs and Development systems during November 2025. Source IDs: BleepingComputer, OSINTSights, Harvard Magazine Inc., UNDERCODE NEWS, 2-Spyware, DataBreach.com

The university‘s disclosure notice said accessed information included donation details and event attendance records, along with biographical information tied to alumni engagement and fundraising, home and business addresses, telephone numbers and email addresses. Have I Been Pwned’s analysis of the leaked data added social media profiles and places of birth to the exposed categories, along with citizenship status, ethnicity and marital status. It also listed names, dates of birth, employers, job titles and family members’ names. Source IDs: BleepingComputer, OSINTSights, UNDERCODE NEWS, 2-Spyware

Harvard Vice President and University Chief Information Officer Klara Jelinkova said the breached systems held no Social Security numbers, passwords or payment card details, and contained no financial information. The university repeated that the affected systems generally do not hold payment card information, passwords and Social Security numbers, and said monitoring continues without any sign of additional unauthorized access. Source IDs: BleepingComputer, OSINTSights, Harvard Magazine Inc., UNDERCODE NEWS, 2-Spyware, DataBreach.com

Have I Been Pwned confirmed on Nov. 3, 2026 that the breach exposed information for 850,500 accounts, tied to roughly 851,000 unique email addresses connected to alumni and fundraising systems. The service said the extensive profile information covers donors, alumni, parents and some faculty, staff and students, and cautioned that unique email addresses do not automatically equal the number of confirmed individual victims. The service said its analysis drew on data leaked by the cybercrime gang. Source IDs: BleepingComputer, Have I Been Pwned, OSINTSights, UNDERCODE NEWS, 2-Spyware

ShinyHunters, described as an extortion gang, claimed responsibility for the intrusion. The gang asserted it took more than a million records containing identifiable information and donation data. Harvard said it has not tied the intrusion to a named hacking group or threat actor. A university spokesperson declined to provide a count of affected individuals.

Source IDs: BleepingComputer, OSINTSights, UNDERCODE NEWS, 2-Spyware, DataBreach.com

Harvard discovered the intrusion on Nov. 18, 2025. Reports described the initial access as phone-based phishing, in which a caller convinces an employee to provide access. Harvard said it took immediate steps to remove the attacker’s access and block further unauthorized access after discovering the intrusion on Nov. 18, 2025. The public tally came roughly one year after the university’s discovery.

Source IDs: BleepingComputer, OSINTSights, Harvard Magazine Inc., UNDERCODE NEWS, 2-Spyware, DataBreach.com

Harvard refused to pay a ransom demanding the return and destruction of stolen data. The gang then published a 1.1GB archive of documents on its leak site in early February 2026; DataBreach.com dates the publication to February 4, 2026. A Feb. 5, 2026 analysis put the leaked material at roughly 1.16 million records, including donation-related material, 608,837 telephone numbers and 1,160,707 e-mail addresses.

On Nov. 22, 2025, Harvard notified individuals with an email address on file whose information was potentially accessed. Chief Information Officer Klara Jelinkova and Alumni Affairs and Development chief James J. Husson signed a Saturday email to university affiliates that day, stating that the breached databases generally lack Social Security numbers, financial account numbers, payment card information and passwords. Source IDs: Harvard Magazine Inc., 2-Spyware, DataBreach.com

Harvard said it worked with outside cybersecurity specialists and law enforcement on the investigation, work Tim Bailey of Harvard University Information Technology described in a statement, and its IT officials launched a website for updates with frequently asked questions. The university established contact channels at cyberincident@harvard.edu and 1-833-556-4315 on Feb. 5, 2026, and advised recipients to be alert for unusual messages about the breach. Its incident FAQ and website listed potentially exposed groups: some faculty and staff, donors, alumni with their spouses or partners, widows and widowers of alumni, parents of current or former students and some current students. Source IDs: Harvard Magazine Inc., 2-Spyware, DataBreach.com

Princeton University and the University of Pennsylvania disclosed data breaches in November 2025 and confirmed that attackers obtained donor information. In a Nov. 25, 2025 report, Harvard Magazine pointed to earlier attacks at Columbia University, New York University, Stanford University and Georgetown University. Source IDs: BleepingComputer, OSINTSights, Harvard Magazine Inc., UNDERCODE NEWS, 2-Spyware

The Harvard incident was separate from an October 2025 matter in which the university told BleepingComputer it was investigating a breach after the Clop ransomware cartel claimed it breached systems using an Oracle E-Business Suite zero-day vulnerability, a previously unknown software flaw. The University of Phoenix disclosed in December 2025 that the gang took data from almost 3.5 million people, including students, staff and suppliers, during an August 2025 intrusion exploiting the same flaw. Source IDs: BleepingComputer, OSINTSights, UNDERCODE NEWS, 2-Spyware

Harvard calls itself a private Ivy League research university. It employs over 20,000 faculty and staff, teaches more than 24,500 undergraduate and graduate students, and counts more than 400,000 alumni worldwide. Source IDs: BleepingComputer, OSINTSights, UNDERCODE NEWS

Have I Been Pwned says to change the affected password right away on every account where it was used, and to turn on multifactor authentication (a login method requiring more than just a password) wherever supported. 2-Spyware advises checking e-mail addresses on Have I Been Pwned, treating messages about Harvard donations or reunions as suspect, never giving codes or passwords to callers, turning on two-step sign-in for e-mail and being cautious about urgent messages about leaked data.