Harvard Breach Exposed Data Linked to 850,500 Accounts, Have I Been Pwned Says

Summary

Have I Been Pwned analyzed data from Harvard’s breach and found information linked to 850,500 accounts. ShinyHunters claimed responsibility and said it stole records; Harvard said the affected systems did not store Social Security numbers, passwords, or payment card or.

Key points

Have I Been Pwned said the leaked data contained 851,000 unique email addresses and profile information linked to 850,500 accounts.
The exposed information included names, email addresses, birth dates, phone numbers, physical addresses, social media profiles, donation details, and event attendance records.
Harvard discovered attackers had accessed its Alumni Affairs and Development systems on November 18, 2025.
ShinyHunters claimed responsibility, saying it stole more than one million records; the gang later leaked a 1.1GB archive after Harvard refused to pay a ransom.
Harvard’s CIO said the affected systems did not store Social Security numbers, passwords, payment card information, or financial information.

Article Details

Victim Organization: Harvard University
Incident Type: Data breach involving unauthorized access to Alumni Affairs and Development systems, data theft, extortion, and publication of leaked documents.
Data Types Exposed: Names
Email addresses
Dates of birth
Telephone numbers
Home and business addresses
Social media profiles
Event attendance records
Donation details
Biographical information related to fundraising and alumni engagement
Affected Records: Have I Been Pwned reported data for 850,500 accounts and 851,000 unique email addresses. ShinyHunters claimed it stole over 1 million records.
Affected Data Size: A 1.1 GB archive of documents was leaked, according to the article.
Operational Impact: Personal information associated with students, alumni, donors, staff, and faculty was exposed. The article does not report service disruption.
Ransom Or Extortion: ShinyHunters claimed responsibility and reportedly leaked the archive after Harvard refused to pay a ransom for the return and destruction of the stolen data.
Claim Status: confirmed