HaveIBeenPwned added a Harvard University dataset on November 3 covering about 850,500 unique email addresses, a count the breach-notification service and BleepingComputer both round to 851,000 accounts. The records come from Harvard’s Alumni Affairs and Development systems, which attackers entered in November 2025, and they sketch alumni, donors and parents in unusual personal detail.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Harvard confirmed the intrusion within days of discovering it. What was new this week was the size of the file.
The 851,000-account figure
The service lists the Harvard entry as added on November 3, 2026, with roughly 850.5 thousand email addresses, according to its own HaveIBeenPwned breach page. BleepingComputer’s report puts the count at 851,000 accounts and says the hackers breached the Alumni Affairs and Development systems in November 2025. Harvard’s spokesperson had said at the time that the university could not say how many people were affected, so the dataset is the first firm count in public. BleepingComputer’s report adds that HaveIBeenPwned counted more than 850,000 unique email addresses in the file, and that the breached systems were those of Alumni Affairs and Development, the office that manages fundraising and alumni relationships.
The listing ties the file to a ShinyHunters “pay or leak” extortion attempt. TechRadar reported in February that the group published stolen Harvard and University of Pennsylvania files on its dark web site after ransom negotiations broke down, claiming more than a million records; TechCrunch verified only part of the dataset. The group had said in early November 2025 that it had full access to a Pennsylvania employee single sign-on account, and Harvard confirmed its own compromise about three weeks later.
How a phone call became a breach
Harvard says it found the incident on November 18, 2025, and traced it to a phone-based phishing attack, commonly called vishing. Its cyber-incident page, last updated December 19, 2025, states that the intruder’s access was removed right away and that the university is working with law enforcement and outside security experts. Notification emails went out on November 22, and Harvard published its public statement the same day. The university described the attack in its own words as phone-based phishing, in which a caller persuades a staff member to hand over access.
The page says Harvard did not yet know exactly which information had been accessed, and that the systems do not generally hold Social Security numbers, passwords or financial account numbers. The statement came from Klara Jelinkova, Harvard’s vice president and chief information officer, and Jim Husson, vice president for Alumni Affairs and Development, as BleepingComputer reported in November 2025.
Anyone on the list should treat calls and messages claiming to come from Harvard with suspicion, particularly any that ask for password resets, since the original attack was itself a voice call.
For anyone on the list, the exposure is mostly social engineering risk. A file that pairs a name with an employer, a family member’s name and a donation history is raw material for a convincing call or email, which is the same route the original attacker used. Harvard urged recipients of its notice to be wary of calls, texts or emails claiming to be from the university, especially those asking for password resets or sensitive details such as passwords, Social Security numbers or bank details. Checking an address on HaveIBeenPwned shows whether it appears in this dataset, though the service lists email addresses, not people, so someone who used a different address with Harvard would not be flagged.
Names, emails and donor records in the stolen file
Harvard’s own notice listed email addresses, phone numbers, home and business addresses, event attendance records and donation details. The HaveIBeenPwned entry is broader: it tags the data classes as names, dates of birth, places of birth, employers, job titles, occupations, education levels, family members’ names, marital statuses, genders, ethnicities, citizenship status, salutations, social media profiles and charitable donations alongside the contact fields.
That longer inventory comes from the leaked file and goes beyond what Harvard’s notice listed, which spoke of biographical information pertaining to fundraising and alumni engagement activities. The people exposed are not limited to graduates: the university said spouses, partners and widows of alumni, parents of current and former students, donors, some current students and some faculty and staff could be in the data. Harvard’s incident page remains the authoritative statement on what the university itself confirmed.
Harvard had a second, separate incident in the same season: in mid-October 2025 the Clop ransomware gang listed the university on its leak site, claiming a zero-day flaw in Oracle’s E-Business Suite. Princeton and the University of Pennsylvania also disclosed donor and alumni breaches that November. The listing on HaveIBeenPwned concerns the phone-phishing breach of Alumni Affairs and Development, not those.
The open question is what Harvard will say now that a count exists. Its incident page was last updated on December 19, 2025, and the university has not said publicly whether it negotiated with the extortionists.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
