Harvard Never Told Anyone How Many People Were Hit. Almost a Year Later, a Third Party Counted 851,000 Email Addresses, and the Data Fields Run Well Past What Harvard Listed.
If you are a Harvard alumnus, donor, or someone who attended an event run by its alumni and development offices, check your address at Have I Been Pwned today and expect phishing that knows your giving history. Have I Been Pwned added the Harvard breach on November 3 and counts 850,500 affected addresses, in the dataset described as 851,000 unique email addresses.
The intrusion was in November 2025, into Harvard's Alumni Affairs and Development systems. Harvard says it discovered the breach on November 18, 2025. The first public count of affected addresses that we found came from Have I Been Pwned almost a year later, because, according to BleepingComputer, a Harvard spokesperson could not share how many individuals had their information exposed.
The number
BleepingComputer reported on November 3 that Have I Been Pwned analyzed the data and confirmed the breach exposed 850,500 accounts. Have I Been Pwned's own page for the breach shows 850.5 thousand addresses in its overview and describes 851 thousand unique email addresses in the text, so the two figures differ slightly on the same page. Harvard has not attributed the attack to a specific group and has not given its own count. The same BleepingComputer article notes that in October 2025 Harvard said it was investigating a separate breach linked to a Clop claim about an Oracle E-Business Suite zero-day, so this is not Harvard's only incident that autumn.
The fields
This is the part that changes who should worry. BleepingComputer, quoting Harvard's disclosure, lists email addresses, telephone numbers, home and business addresses, event attendance records, donation details and biographical information. Have I Been Pwned's page lists these data classes: charitable donations, citizenship statuses, dates of birth, education levels, email addresses, employers, ethnicities, family members' names, genders, job titles, marital statuses, names, occupations, phone numbers, physical addresses, places of birth, salutations and social media profiles.
The second list is broader than the first. Dates of birth, ethnicities, citizenship statuses, marital statuses, places of birth and family members' names are not in Harvard's list as BleepingComputer quoted it. We are not saying Harvard misled anyone. A short disclosure sentence and a data-class list built from the stolen file describe the same thing at different levels of detail. But a person reading only Harvard's version would underestimate what an attacker holds.
Harvard's chief information officer, Klara Jelinkova, said the systems did not store Social Security numbers, passwords, payment card information or financial information. Nothing we read contradicts that.
What ShinyHunters said
According to BleepingComputer, the ShinyHunters extortion group claimed it stole over one million records containing identifiable information and donation data. It posted a 1.1 gigabyte archive on its leak site in early February 2026 after Harvard refused to pay a ransom to have the stolen data returned and destroyed. Harvard has not named the group. The reporting does not say how the intruders got in. Press coverage in November 2025 described the breach as following a phone phishing attack, but we did not read those reports and BleepingComputer's piece does not state a method, so we are not relying on it.
We covered ShinyHunters' attack on education before, in ShinyHunters Hit Canvas: 275 Million Records Across 9,000 Schools. We did not cover this breach when it happened.
What to do
Check your address at Have I Been Pwned. The breach is now listed there.
Treat any call, email or text that mentions your donations, your events or your family as possible phishing. The data that would make it convincing is in the file. Hang up and call the university back on a number you find yourself.
Harvard says passwords were not stored, so this breach alone is not a reason to change them, though changing them does no harm. The exposure is personal details, not credentials. That is our reading of Harvard's statement.
If you work in advancement or alumni relations anywhere, the lesson is about what a development system holds. Donation history, family names and biographical detail together are a ready-made pretext for a targeted call.
What we hold, and what we don't
We hold no indicators for this breach, because none were published, so we added nothing to our feed. We have no sighting of our own. We are citing BleepingComputer's report and Have I Been Pwned's listing.
Limits
This rests on BleepingComputer's November 3 article, which we read, and Have I Been Pwned's breach page, which we read. We did not read Harvard's own notice, the CyberNews report on the breach, or the TechCrunch article from February that Have I Been Pwned links, because the first two were blocked to our fetch and the third we did not open. The claim that Harvard's disclosure listed a narrower set of fields comes from BleepingComputer's quotation of it, not from Harvard's page. The ShinyHunters claims are as BleepingComputer reports them, and Harvard has not confirmed them.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments