Hackers broke into Harvard University’s Alumni Affairs and Development systems in November 2025 and took data tied to more than 850,000 unique email addresses. The university later said the exposed records reached students, alumni, donors, staff, and faculty, while the breached systems did not hold Social Security numbers, passwords, payment card information, or financial information.
Harvard’s disclosed data loss
Klara Jelinkova, Harvard’s Vice President and University Chief Information Officer, said the compromised systems included personal information drawn from the university’s alumni and fundraising activity. The material covered email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and biographical information tied to fundraising and alumni engagement. Harvard is a private Ivy League research university with more than 20,000 faculty and staff, over 24,500 undergraduate and graduate students, and more than 400,000 alumni worldwide.
The university found the intrusion on November 18, 2025. Harvard did not attribute the incident to any specific hacking group or threat actor, but the ShinyHunters extortion gang said it carried out the attack and stole over 1 million records containing identifiable information and donation data. The gang later posted a 1.1GB archive of documents on its dark web leak site in early February after Harvard refused to pay a ransom for the return and destruction of the stolen data.
What breach disclosures showed
BleepingComputer said a Harvard spokesperson did not say how many people were affected when asked for more detail at the time. Have I Been Pwned later analyzed the leaked material and said on Tuesday that the breach exposed data for 850,500 accounts, including names, email addresses, dates of birth, phone numbers, physical addresses, social media profiles, and more. It added that the leak contained 851,000 unique email addresses linked to the university’s alumni and fundraising systems, along with extensive profile information for donors, alumni, parents, and some faculty, staff, and students.
Other university breaches in 2025
Two other Ivy League schools, Princeton University and the University of Pennsylvania, disclosed breaches in November 2025. Both said attackers accessed donors’ information.
In October 2025, Harvard told BleepingComputer that it was investigating a second breach after the Clop ransomware gang claimed it had broken into the university using an Oracle E-Business Suite zero-day vulnerability. Two months later, the University of Phoenix joined the list of US universities hit by Clop through the same Oracle EBS flaw and said the gang stole data from nearly 3.5 million students, staff, and suppliers in August 2025.
Licensed under CC BY-ND 4.0 International