About 851,000 unique email addresses tied to Harvard University’s Alumni Affairs and Development systems are now searchable on the breach notification service Have I Been Pwned, nearly a year after the university disclosed a voice phishing attack on those systems. The service added the data set on November 3, 2026, and listed 850,500 affected accounts.
Harvard confirmed the intrusion in November 2025. Have I Been Pwned says the incident was later linked to a ShinyHunters “pay or leak” extortion attempt. Harvard has not publicly attributed the attack to any group, and the university had not issued any public statement about the new Have I Been Pwned figures at time of publication.
What Harvard confirmed in 2025
According to a Harvard University Information Technology FAQ first posted on November 22, 2025, the university discovered on Tuesday, November 18, 2025, that an unauthorized party had gained access to information systems used by Alumni Affairs and Development. Harvard said the attacker got in through a phone-based phishing attack, a technique often called vishing, where a caller tricks staff into giving up access.
Harvard said it removed the attacker’s access, took steps to block further unauthorized access, and began working with law enforcement and third-party cybersecurity experts. The FAQ was last updated on December 19, 2025.
The university said the affected systems generally do not hold Social Security numbers, passwords, payment card details or financial account numbers. They do contain contact details, event attendance records, donation information and biographical details used for fundraising.
Who was affected
Harvard said the systems hold information about a wide range of people connected to the school, including:
- Alumni and their spouses, partners and widows
- Donors and parents of students
- Some current students
- Some faculty and staff members
Data listed by Have I Been Pwned
Have I Been Pwned lists a broad set of personal and fundraising details in the data set. The exposed fields include:
- Names, salutations, email addresses, phone numbers and physical addresses
- Dates of birth, places of birth, genders and marital statuses
- Ethnicities and citizenship statuses
- Education levels, employers, occupations and job titles
- Names of family members and social media profiles
- Records of charitable donations
The data does not appear to include passwords or payment card numbers, which matches what Harvard said in 2025. Still, the mix of donation history, family details and contact information is useful for targeted fraud. Wealthy donors and well-known alumni are attractive targets for scammers who pose as university staff or fundraising officers.
ShinyHunters extortion claim
ShinyHunters, an established extortion group, claimed the Harvard intrusion and, according to reports, published the stolen data in early February 2026 after the university did not pay. The group has repeatedly targeted universities and education vendors through social engineering and stolen login credentials. BreachNews has covered its campaigns against Instructure, the University of Nottingham and several U.S. colleges, along with its exploitation of an Oracle PeopleSoft zero-day at universities. More background on the group is on our ShinyHunters threat actor page.
Voice phishing has become a common entry point in these attacks. Callers pose as IT help desk staff, then convince employees to approve logins or reset multifactor authentication, which gives the attacker access to cloud and alumni systems without any malware.
What alumni and donors should do
Anyone with ties to Harvard can check whether their email address appears in the data set. People who find their address in it should take these steps:
- Treat unexpected calls, texts and emails about donations, reunions or account problems with caution, even if they mention real details about you.
- Contact Harvard only through phone numbers and websites you find yourself, not through links or numbers in a message.
- Never give a caller a login code, password or multifactor approval.
- Watch for scams that use your birthday, family names or employer to sound legitimate.
Because dates of birth and addresses are in the data, some people may also want to freeze their credit as a precaution. Anyone who receives a letter about the incident can use our guide on how to tell if a data breach notification letter is real.
