The Harvard University data breach is the November 2025 intrusion into the university's Alumni Affairs and Development systems, listed by Have I Been Pwned on 3 November 2026 with 850,537 email addresses. Harvard discovered the intrusion on 18 November 2025 after a phone-based phishing attack, and notified potentially affected people by email on 22 November 2025, according to Harvard's incident notice as reported by eSecurity Planet and ZeroDayFeed. The listing is not a new intrusion into Harvard systems. The November 2026 development is the public catalogue entry and its count, nearly a year after Harvard disclosed the incident, and the count refers to email addresses in the dataset, not to a confirmed number of affected individuals.
November 2025 intrusion
Harvard discovered the intrusion on 18 November 2025 in systems used by its Alumni Affairs and Development office, the office that handles fundraising and contact with graduates, according to Harvard's incident notice as reported by eSecurity Planet. Harvard attributed the entry to a phone-based phishing attack, in which a caller persuades an employee to hand over access, and the reports of the notice name no software flaw as the entry method. Harvard notified potentially affected people by email on 22 November 2025, and stated that it had found no evidence of further unauthorised access, according to the same reporting. The notice was last updated on 19 December 2025, according to ZeroDayFeed, which cites an archived copy of the notice after reporting that the live Harvard page returned Access Denied. The groups Harvard listed as possibly affected are alumni, alumni spouses and partners, donors, parents of current and former students, some current students, and some faculty and staff, according to eSecurity Planet.
Data in the listing
Have I Been Pwned lists the Harvard dataset with a breach date of November 2025 and a pwn count of 850.5 thousand, and the exact count of 850,537 accounts is confirmed by the HIBP-derived listing at Acidpeak and by ISec News. The data categories in the listing include names, email addresses, dates of birth, phone numbers, physical addresses, donation information, employers, citizenship statuses, ethnicities, family members' names, education levels, job titles, marital statuses, and genders, according to the same HIBP-derived listing. Not every record necessarily contains every category, and Have I Been Pwned counts unique email addresses found in the data rather than confirmed affected individuals. Harvard's original notice grouped much of this material under a broad biographical information heading, so a reader of the notice alone would not have seen citizenship status, ethnicity, and family members' names itemised separately. Harvard said the affected systems do not generally contain Social Security numbers, passwords, payment card information, or financial account numbers, according to eSecurity Planet and 2-spyware. The exposure in this dataset is therefore contact detail and relationship detail, not credentials or payment data.
Attribution claims
ShinyHunters claimed responsibility for the breach, claimed to have taken more than one million records, and published a 1.1GB archive in early February 2026 after Harvard refused to pay a ransom, according to reporting by BleepingComputer and TechCrunch as summarised by ZeroDayFeed. These figures are the group's own claims and have not been independently confirmed, and Harvard has not publicly attributed the attack to ShinyHunters. The claimed record count and Have I Been Pwned's tally of unique email addresses measure different things, since a stolen database can hold several rows per person, although no source explains the gap between the two figures directly. No source cited in this article reports a confirmed phishing campaign using this dataset.
Steps for affected people
Checking an address on Have I Been Pwned shows whether it appears in the Harvard dataset. A result naming Harvard means the address appeared in that dataset, and it does not prove that a password was stolen, since Harvard says passwords are not generally held in these systems. Messages that mention Harvard, a donation, a reunion, or a fundraising campaign can be checked through contact details found independently, rather than through a number or link in the message itself, and a caller who quotes a graduation year or a past gift has not thereby proved identity. Codes, passwords, and card numbers are not shared with a caller on the basis of quoted biographical detail, and email accounts carry two-step sign-in because email is used to reset other accounts. The use of leaked contact detail in impersonation messages is described in how phishing uses a leaked email address, and the separation of a donation from a permanent address is described in how to protect an email address when donating to charity.
Your address is probably in this file. Check whether it is, do the checks above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Response and open questions
Harvard has not publicly commented on the Have I Been Pwned number, and ZeroDayFeed notes that Harvard did not immediately respond to The Register's request for more information on the new figure. The original notice left open precisely what information was accessed for each person, and the Have I Been Pwned listing does not close that gap, since it gives data categories for the dataset as a whole rather than per-person contents. The chronology stands as follows: the intrusion dates to November 2025, an attacker claim followed in February 2026, and the Have I Been Pwned listing on 3 November 2026 gave the HIBP count of 850,537 email addresses.
| Date | Development |
|---|---|
| 18 November 2025 | Harvard discovered the intrusion in its Alumni Affairs and Development systems. |
| 22 November 2025 | Harvard notified potentially affected people by email. |
| Early February 2026 | ShinyHunters published a claimed 1.1GB archive after Harvard refused a ransom, according to reporting summarised in this article. |
| 3 November 2026 | Have I Been Pwned listed the Harvard dataset, with 850,537 email addresses. |
The biographical and donation detail in the dataset cannot be reset in the way a password can, and that detail remains in circulation.
Top comments (0)