Data from 850,500 people was exposed in a breach of Harvard University’s Alumni Affairs and Development systems, according to Have I Been Pwned (HIBP), which tracks data breaches. The leaked material included 851,000 unique email addresses and extensive profile information linked to alumni and fundraising activities.
HIBP says the information included names, email addresses, dates of birth, phone numbers, postal addresses and social media profiles. The affected groups included donors, alumni, parents, and some faculty, staff and students.
Harvard confirmed in late November 2025 that the systems had been compromised in a voice-phishing attack. The systems held information about members of the university community and their relatives, including contact details, event attendance records, donation information and biographical details used for fundraising and alumni engagement.
The university said Social Security numbers, passwords, payment card information and financial information were not exposed. The attackers were not named by Harvard at the time, but the ShinyHunters group later claimed responsibility. After negotiations with the university broke down, the group said it leaked more than 1.1 GB of documents in early February.
The incident followed breaches affecting Princeton University and the University of Pennsylvania. Penn later confirmed that an attacker used social engineering to access information, after initially describing emails sent during the incident as fraudulent.
Sources: TechRadar.