Harvard University Reveals Data Breach Exposed 851,000 Accounts
follow us
Add us as a preferred source on Google
- Data on Harvard security breaches affecting 850,500 people has now appeared in breach tracking databases and dark web archives
- The information exposed includes emails, contact details, demographic data and extensive profile data of alumni and donors.
- Attack highlights ongoing risks of social engineering attacks against universities and fundraising systems
Hundreds of thousands of email addresses were leaked to the dark web after the November 2025 ShinyHunters breach at Harvard University.
The same breach also exposed “extensive profile information” about certain people, according to Have I Been Pwned? (HIBP), a website that aggregates stolen passwords and helps users know which services exposed their private information.
Harvard gets hit
In late November 2025, the prestigious Ivy League University confirmed that its Development and Alumni Affairs systems had been compromised after a successful voice phishing (vishing) attack.
Latest videos ofTechnologyRadar
These systems contained information about alumni, donors, some faculty and staff, and some current students, as well as data about their spouses, partners, and parents. Current and former students were also said to be affected.
Harvard soon confirmed that the compromised data included email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and “biographical information related to the University’s fundraising and alumni engagement activities.” It was said that Social Security numbers, passwords, payment card information or financial information were not exposed.
At the time, Harvard did not name the attackers, but the infamous extortion group ShinyHunters claimed responsibility soon after. In a new post on a dark web forum, threat actors said they stole more than one million records containing personally identifiable information (PII) as well as donation data. Since negotiations with the university failed, the group leaked more than 1.1 GB of documents in early February this year.
At the time, no one knew exactly how many people were affected. Now, after thoroughly analyzing the leaked file, HIBP claims that data from 850,500 accounts was compromised, including people’s names, email addresses, dates of birth, phone numbers, postal addresses and social media profiles.
“The data contained 851,000 unique email addresses related to the university’s fundraising and alumni systems, along with extensive profile information on donors, alumni, parents, and some faculty, staff, and students,” he said.
Attack universities
When Harvard “fell” into the hands of ShinyHunters, they were the third university to experience a breach in just a few weeks, following similar incidents at both Princeton University and the University of Pennsylvania.
In early November 2025, when ShinyHunters claimed responsibility for the Penn hack, they said they had stolen data from approximately 1.2 million students, alumni, and donors.
At the time, an anonymous threat actor told media they gained “full access” to a university employee’s PennKey SSO account, giving them access to Penn’s VPN, Salesforce data, the Qlik analytics platform, SAP’s business intelligence system, and SharePoint files.
The criminals criticized Penn for being a “shitty elitist institution full of woke retirees who have “terrible security practices and are completely undeserving.”
“We hire and admit morons because we love legacies, donors, and unqualified affirmative action. We love violating federal laws like FERPA (all your data will be leaked) and Supreme Court rulings like SFFA,” ShinyHunters said in an email sent from a Penn account.
The University of Pennsylvania initially described the emails as “obviously false” and “fraudulent,” but then backtracked and confirmed the incident.
“Penn staff quickly locked down systems and prevented unauthorized access, however, not before an offensive and fraudulent email was sent to our community and information was taken by the attacker,” he said in an update. “Penn is still investigating the nature of the information that was obtained during this time.”
Penn also said the attack was carried out through social engineering. Most employees are required to use multi-factor authentication (MFA), but some higher-ups were reportedly allowed to skip this step.
Through beepcomputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment