A newly verified analysis of Harvard University’s November 2025 cyberattack has identified 850,537 unique email addresses in stolen alumni and fundraising records. Have I Been Pwned added the dataset to its breach-notification service on November 3, 2026, revealing the extensive scale of the incident. Harvard discovered the intrusion on November 18, 2025, after attackers used phone-based phishing to access Alumni Affairs and Development systems. The compromised information involved alumni, donors, parents, and some students, faculty, and staff.
STOLEN DATA EXPOSES PERSONAL AND FINANCIAL PROFILES
The exposed records contained names, email addresses, telephone numbers, home addresses, dates of birth, citizenship status, family relationships, employment details, education history, and charitable donation information. Although passwords, payment-card information, and Social Security numbers were not generally included, the detailed profiles could enable identity fraud, targeted phishing, and impersonation attacks. The ShinyHunters extortion group claimed responsibility for the breach, but Harvard and law enforcement have not publicly confirmed that attribution. The 850,537 figure represents unique email addresses, meaning the total number of affected individuals could be higher.
CYBERSECURITY RISKS AND PROTECTIVE MEASURES
The newly verified findings highlight the growing threat of social engineering attacks against universities and nonprofit organizations. Cybercriminals could exploit stolen donation histories, employment information, and family relationships to create convincing phishing emails, fraudulent telephone calls, and AI-generated impersonation campaigns. Harvard-affiliated individuals should remain cautious of unexpected communications, verify financial requests through trusted channels, and enable phishing-resistant multifactor authentication. Universities should strengthen access controls, monitor unusual database exports, and enforce secure identity-verification procedures to prevent similar breaches.