Harvard data breach: 850K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2025-11-22
Harvard University says that on Tuesday 18 November 2025 it discovered that an unauthorized party had reached information systems used by its Alumni Affairs and Development office through a phone-based phishing attack, and that it removed the attacker's access. Harvard's FAQ says those systems do not generally hold Social Security numbers, passwords, payment card or financial account numbers, but do hold contact details, home and business addresses, event attendance, donation history and other biographical data about alumni, donors, parents, some current students, and some faculty and staff. Harvard has not named a threat actor. The ShinyHunters extortion gang claimed the breach; BleepingComputer reports that it leaked a 1.1GB archive in early February 2026 after Harvard refused to pay a ransom. The gang's claims of more than 1 million stolen records and of the ransom refusal are unverified, and Harvard has not said how many people were affected. Have I Been Pwned, which lists the breach as verified, loaded it on 3 November 2026 as 850,537 accounts (about 851k unique email addresses), with names, dates of birth, phone numbers, physical addresses, social media profiles, employers and other profile fields. Clop separately claimed a Harvard breach through an Oracle E-Business Suite zero-day; Harvard said in October 2025 it was investigating a second incident, and reporting does not link that to this one. No vendor patch applies. The response is notification, phishing awareness, and monitoring for misuse of exposed contact and donor data.
What to do
- If you had a Harvard account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
