Harvard breach data surfaces after leak

The numbers attached to the Harvard University breach kept moving for months. First came a confirmation in late November 2025 that attackers had reached Alumni Affairs and Development systems through a voice phishing attack. Then came a leak of more than 1.1GB of documents in early February after negotiations broke down. What stayed uncertain was how many people were actually in the files. Have I Been Pwned? now says it has an answer after going through the archive.

That answer is 851,000 unique email addresses, according to the breach-notification service, which reported its findings and was cited in coverage by BleepingComputer. The figure lands close to, but not identical with, the 850,500 accounts that breach-tracking databases have listed — a discrepancy worth keeping straight, because the two numbers come from different tallies of the same leak.

A vishing call, then a leak

Harvard's public account of the incident begins with a phone call. The university confirmed in late November 2025 that its Alumni Affairs and Development systems had been compromised following a successful voice phishing, or vishing, attack. Those systems held information about alumni, donors, some faculty and staff, and some current students, along with data on their spouses, partners, and parents. Current and former students were affected as well.

Harvard also spelled out what the compromised data contained: email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and what the university described as biographical information pertaining to its fundraising and alumni engagement activities. The university said Social Security numbers, passwords, payment card information, and financial information were not exposed.

At the time, Harvard did not name the attackers. The ShinyHunters extortion group claimed responsibility soon afterward, posting to a dark web forum that it had taken more than a million records containing personally identifiable information as well as donation data. When negotiations with the university broke down, the group leaked more than 1.1GB of documents in early February.

What HIBP found inside the archive

Have I Been Pwned?, which the source describes as a website that aggregates stolen passwords and helps users learn which services exposed their private information, said it analyzed the leaked archive at length before publishing its count. The exposed fields it identified include names, email addresses, dates of birth, phone numbers, postal addresses, and social media profiles.

"The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students," it said.

The service has not been named as the speaker beyond that pronoun in the source coverage; the statement is attributed to HIBP as the body that analyzed the archive.

The profile detail matters as much as the email count. A list of addresses alone tells an attacker who to contact. A list that pairs those addresses with donation history, event attendance, and family relationships tells an attacker what to say. Harvard's own description of the compromised systems — alumni engagement and fundraising — maps closely onto the fields HIBP says it found.

The numbers, side by side

• 851,000 unique email addresses in the leaked archive, per Have I Been Pwned?'s analysis
• 850,500 accounts listed as affected in breach-tracking databases
• More than 1 million records ShinyHunters claimed to have stolen, including PII and donation data
• More than 1.1GB of documents leaked in early February after negotiations collapsed
• Late November 2025 — when Harvard confirmed the compromise of its Alumni Affairs and Development systems
• Three universities hit within weeks, with Princeton University and the University of Pennsylvania breached around the same period
• Roughly 1.2 million students, alumni, and donors in the data ShinyHunters claimed from Penn

The gap between the attacker's claim and the verified count is not unusual in extortion cases, but here it has a concrete shape: the group said more than a million records, the leaked archive yielded about 851,000 unique addresses, and public breach trackers settled on 850,500 accounts. Each figure measures something slightly different — records claimed, addresses deduplicated, accounts listed — which is why they do not line up neatly.

Penn, Princeton, and a pattern of phone calls

Harvard was not the first university in the group's path that autumn. When ShinyHunters struck, it was the third university to experience a breach in a matter of weeks, following similar incidents at Princeton University and the University of Pennsylvania.

Penn's case is the most documented. In early November 2025, when ShinyHunters claimed responsibility for the attack on Penn, the group said it had stolen data on roughly 1.2 million students, alumni, and donors. An unnamed threat actor told media at the time that they had gained full access to a university employee's PennKey SSO account, which opened the door to Penn's VPN, Salesforce data, Qlik analytics platform, SAP business intelligence system, and SharePoint files.

The group's messages about Penn were crude and personal, attacking the institution's admissions and security practices in profane terms and claiming it broke federal laws including FERPA, as well as Supreme Court rulings. One such email was sent from a Penn account.

Penn initially described the emails as obviously fake and fraudulent, then reversed course and confirmed the incident. In an update, the university said its staff rapidly locked down the systems and prevented further unauthorized access, though not before an offensive and fraudulent email went out to its community and information was taken. Penn said it was still investigating the nature of what was obtained, and that the attack had been carried out through social engineering. Most employees were required to use multi-factor authentication, but according to reports, some senior officials were permitted to skip that step.

Why fundraising systems draw attackers

Alumni and development offices sit in an unusual position inside a university. They hold contact details and giving histories for people who may no longer have any day-to-day relationship with the institution, plus information about spouses, partners, and parents who never signed up for anything themselves. That data is maintained for outreach, which means it is kept current, organized, and tied to real relationships.

Harvard's disclosed field list reflects exactly that: event attendance, donation details, biographical information tied to fundraising and alumni engagement. None of it is the kind of data a password manager protects, and none of it was described as including Social Security numbers, passwords, payment card information, or financial information. What it does include is enough to identify a person, reach them, and know something about their history with the university.

The vishing entry point is consistent with how the group has operated against universities in this cluster. Penn attributed its incident to social engineering. Harvard attributed its own to voice phishing. In both cases, the described route in ran through people and their accounts rather than through a flaw in exposed software.

What Harvard has said, and what it hasn't

Harvard's public statements have covered the scope of the systems involved, the categories of people affected, and the fields of data exposed. The university confirmed that spouses, partners, and parents of alumni, donors, faculty, staff, and students were caught up in the data, along with current and former students.

What Harvard has not done publicly is attach a specific account count to the incident. That number emerged from HIBP's analysis of the leaked files and from breach-tracking databases, not from the university's own disclosures. The distinction is worth holding onto: the 851,000 and 850,500 figures are measurements of a leak that is already circulating, not official victim counts issued by Harvard.

The timeline also matters for anyone trying to work out whether they are included. The compromise was confirmed in late November 2025. The leak came in early February. HIBP's analysis followed. People whose details sat in those fundraising systems have had months in which the data was held by an extortion group and then, after the leak, available more widely.

Checking whether you are in the file

For individuals connected to Harvard — alumni, donors, parents, faculty, staff, or students — the practical step described in the reporting is straightforward. Have I Been Pwned? exists to let people check whether their private information appears in known breaches, and it has now indexed this archive.

The fields involved shape what to watch for. Email addresses, phone numbers, postal addresses, dates of birth, and social media profiles were all part of the exposed set. So were donation details and event attendance records. Anyone who receives a message that references a specific gift, a specific event, or a family connection to the university should treat that specificity as a signal about where the sender's information may have come from, not as proof the sender is legitimate.

Harvard said passwords, payment card information, financial information, and Social Security numbers were not part of the exposed data, so there is no indication from the source that credentials or payment details from these systems need to be treated as compromised.

The wider question for institutions

The Harvard incident, as reported, is one entry in a short sequence: Princeton, Penn, Harvard, all within weeks, all tied publicly or by claim to ShinyHunters, and in the two cases with detailed accounts, both attributed to social engineering rather than a software vulnerability. Penn's disclosure that some senior officials could skip multi-factor authentication sits alongside its statement that most employees were required to use it.

What that suggests, cautiously, is that the value of an alumni and fundraising database to an attacker may be out of proportion to how heavily it is defended compared with research or student-record systems. The data is rich, the population is large, and the people in it are reachable long after they leave. Whether other institutions draw that conclusion from Harvard's experience is not something the source establishes. But the sequence of three universities in a matter of weeks, and the confirmed role of voice phishing at Harvard and social engineering at Penn, gives security teams at comparable institutions a specific scenario to test against their own fundraising operations — starting with who can be talked into handing over access, and what sits behind the accounts they hold.