Thought Leadership
Have I Been Pwned evaluated the data published by ShinyHunters from the November 2025 attack. Affected are alumni, donors, and parents.
In the 2025 attack on Harvard University, data on approximately 850,500 accounts was leaked. The notification service Have I Been Pwned (HIBP) announced this on November 3, 2026, after evaluating the data published by the attackers. Harvard itself had not named a figure.
“The data contained 851,000 unique email addresses from the university’s alumni and fundraising systems as well as extensive profile information on donors, alumni, parents, and some faculty, employees, and students.”
Have I Been Pwned
The data includes names, email addresses, dates of birth, phone numbers, postal addresses, and social network profiles. 64 percent of the email addresses were already recorded in the service’s database from previous data breaches. Those affected can check there whether their address is impacted.
No Social Security Numbers
Harvard had detected the attack on the systems of its Alumni Affairs and Development department on November 18, 2025. According to reports, the attackers gained access via phishing. CIO Klara Jelinkova stated at the time that no Social Security numbers, passwords, payment card, or financial data were stored in the affected systems.
The extortion group ShinyHunters claimed responsibility for the attack and stated that it had obtained more than one million data records containing personal details and donation data. After Harvard did not pay a ransom, the group published a 1.1 GB archive on its leak site in February 2026. Harvard has not attributed the attack to any specific group.
Further Universities Affected
In November 2025, Princeton University and the University of Pennsylvania had also reported attacks in which donor data was leaked. Harvard had also been reviewed in October 2025 in connection with a vulnerability in Oracle E-Business Suite.
Investigators are now taking increased action against ShinyHunters. Since September, several suspected members have been arrested in the Netherlands, Jordan, and the US. According to FBI investigators, managers of companies for ransom negotiations are also said to have collaborated with the group. The stolen data can be used to prepare targeted phishing attacks against alumni and donors. Those affected should be particularly cautious with unexpected inquiries relating to Harvard.
(Editorial Team)
