What Harvard says was exposed — and what it did not
Harvard University discovered on November 18, 2025, that attackers had gained access to its Alumni Affairs and Development systems after a breach in November 2025. The university identified that personal information for students, alumni, donors, staff, and faculty had been accessed, including email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and "biographical information pertaining to University fundraising and alumni engagement activities." At the same time, the university's CIO expressly said the compromised systems did not contain Social Security numbers, passwords, payment card information, or financial information.
Harvard, a private Ivy League research university, has over 20,000 faculty and staff, over 24,500 undergraduate and graduate students, and more than 400,000 alumni worldwide — the population potentially affected by data tied to alumni and fundraising systems.
Scale of the leak as analyzed by Have I Been Pwned
Initial public detail on how many individuals were affected was sparse: a Harvard spokesperson told BleepingComputer at the time that the university could not share a figure. Independent analysis of the materials leaked by the attackers, however, was carried out by breach-notification service Have I Been Pwned (HIBP). HIBP confirmed on Tuesday that the breach exposed the data of 850,500 accounts.
HIBP summarized the contents of the published archive this way: "The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students." The leaked records included names, email addresses, dates of birth, phone numbers, physical addresses, social media profiles, and other profile fields.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildShinyHunters' claim and the public leak
Harvard has not publicly attributed the intrusion to a named threat actor. The ShinyHunters extortion gang, however, claimed responsibility for the intrusion and asserted it had stolen more than 1 million records that contained identifiable information and donation data. According to the gang's own actions, after Harvard refused to pay a ransom to have the stolen data returned and destroyed, the attackers published a 1.1GB archive of documents on their dark web leak site in early February.
Related incidents: Clop claims and other university disclosures
The Harvard disclosure sits alongside several other university incidents in late 2025. Two other Ivy League schools, Princeton University and the University of Pennsylvania, disclosed data breaches in November 2025 and confirmed that attackers accessed donors' information. In October 2025, Harvard also said it was investigating a separate breach after the Clop ransomware gang claimed it had exploited an Oracle E-Business Suite (EBS) zero-day to access university systems. Two months later, Clop claimed responsibility for breaching the University of Phoenix, saying it stole data from nearly 3.5 million UoPX students, staff, and suppliers in August 2025 using the same Oracle EBS flaw.
What this means for donors, alumni, and university IT leadership
- Donors and alumni: Name, contact, donation and event-attendance records were among the items published. Those individuals should expect that identifiable donor and engagement information tied to university fundraising systems may be exposed.
- Faculty, staff, and students: While Harvard said that some faculty, staff and students appeared in the leaked profiles, the CIO emphasized that the compromised systems did not include Social Security numbers, passwords, payment card information, or financial information — important distinctions, but not a complete shield against targeted scams or identity misuse.
- University IT and development teams: The incident, and the contemporaneous disclosures of breaches at peer institutions, underscores the operational challenge of protecting alumni and fundraising systems and responding to extortion demands; Harvard notably declined to pay a ransom and the attackers subsequently published the stolen archive.
The published record in this case sets clear facts: a November 2025 breach of Harvard's alumni and fundraising systems led to the public release of a substantial archive and, by HIBP's count, data tied to some 850,500 accounts. Harvard's refusal to pay a ransom preceded the leak of a 1.1GB archive by the claiming actor, and the university maintains that the breached systems did not contain Social Security numbers, passwords, payment card information, or financial information. What remains is whether Harvard and other affected institutions will disclose further forensic detail, remediation steps, or attribution; for now the tangible consequences fall on the donors, alumni, and community members whose identifying and profile information was published.
