Harvard’s November 2025 data breach involved access gained through a phone scam and exposed 851,000 unique email addresses and user profiles, including personal details and donation histories.
Harvard said passwords, Social Security numbers and banking data were not exposed.
ShinyHunters claimed responsibility, and Have I Been Pwned confirmed exposure involving 850,500 accounts.
How the systems were accessed
The attackers managed to gain access to the university's systems using a phone scam. In this method, the attacker pretends to be someone else, such as a support technician, to convince an employee to give them access or passwords.
What evidence was exposed?
The data leaked includes names, email addresses, phone numbers, mailing addresses, dates of birth and donation history to the university. The institution has clarified that no passwords, social security numbers or banking information of users were exposed in the attack.
The publication of data
The group ShinyHunters claimed responsibility for the attack. After negotiations with the university failed, the attackers posted a 1,1GB file on a dark web forum in February 2026. Leak monitoring service Have I Been Pwned later confirmed that the file contained 850.500 unique accounts.
Similar attacks at other universities
The Harvard attack wasn't the only one of its kind during that period. The same group also reportedly targeted Princeton and the Universities of Pennsylvania. The University of Pennsylvania confirmed that its own breach was also carried out through employee deception, which led to the loss of control of an employee account.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Researchers: Nikke's Windows launcher could secretly install computer control program
↗
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)