Harvard breach added to Have I Been Pwned: 850,500 alumni and donor emails, what to do

Have I Been Pwned (HIBP) added the Harvard University alumni and fundraising breach to its database on 3 November 2026, listing about 850,500 affected email addresses. The data comes from systems Harvard says an unauthorised party reached in November 2025 through a phone-based phishing attack, and which the ShinyHunters extortion group published in early February 2026. If you are a Harvard alum, donor or parent, you can now check whether your address is in the set, and you should expect convincing, personalised phishing.

Key points

• HIBP added the Harvard breach on 3 November 2026: about 850,500 affected addresses (the entry cites 851,000 unique email addresses), from an intrusion in November 2025.
• Harvard says it discovered on 18 November 2025 that Alumni Affairs and Development systems were accessed after a voice phishing (vishing) attack; it says those systems did not hold Social Security numbers, passwords, payment card or financial information.
• ShinyHunters claimed the theft and published what TechCrunch reported as more than 1 million records each from Harvard and the University of Pennsylvania on 4 February 2026, after what the group said were refused ransom demands.
• HIBP lists exposed fields including names, email addresses, phone numbers, physical addresses, dates of birth, employers, job titles, family members' names and charitable donations.
• Harvard has not said how many people were affected, and has not attributed the attack to a named group.

What to do

• Check your address. Search it on haveibeenpwned.com. The Harvard entry now covers about 850,500 addresses, so a hit means your contact and biographical details were in the leaked archive.
• Treat unexpected calls, texts and emails as suspect, especially ones that mention Harvard, giving, reunions or a family member. The data includes donation details, event attendance and relatives' names, which is exactly what a scammer needs to sound credible. This is our general advice, not a statement from Harvard.
• Do not act on a request made by phone or message. Hang up and contact Harvard or your bank through a number you look up yourself.
• Passwords: Harvard says the systems did not store passwords, so a reset is not required because of this breach. If you reuse a password anywhere, change it anyway.
• Use a password manager and multi-factor authentication on email and financial accounts, preferably with passkeys or security keys, which resist the phishing methods used here.
• If you work in IT or security: the intrusion method matters more than the dataset. A vishing call that gets an employee to hand over access defeats many password-based defences. Train staff on help-desk and callback procedures.

What happened

Harvard's own notice says that on Tuesday, 18 November 2025, it discovered that information systems used by Alumni Affairs and Development had been accessed by an unauthorised party as the result of a phone-based phishing attack. BleepingComputer reports that Harvard's Vice President and Chief Information Officer, Klara Jelinkova, said the affected systems did not store Social Security numbers, passwords, payment card information or financial information.

The attackers kept the data. On 4 February 2026, TechCrunch reported that ShinyHunters had claimed responsibility for the Harvard and University of Pennsylvania breaches and had published, on its extortion site, what it said were more than 1 million records from each university. The group said it released the data because the universities refused to pay. TechCrunch said the data appeared to match the types of information both universities said were stolen, and that it confirmed a portion of the dataset against alumni and public records.

Nine months later, HIBP processed that archive. Its entry, dated 3 November 2026, gives the breach date as November 2025 and counts 850.5 thousand affected addresses. BleepingComputer, which covered the HIBP addition, describes the leaked archive as 1.1 GB. Harvard did not tell BleepingComputer how many people were affected.

The figures do not match, and that is normal. ShinyHunters spoke of more than a million records; HIBP counts unique email addresses. One person can appear in several records, and some records have no email address. We therefore treat 850,500 as the number of addresses HIBP loaded, not as a headcount of people harmed, and Harvard has not confirmed either figure.

Background

The attack belongs to a pattern in late 2025. UPenn confirmed in November 2025 a breach of systems related to its development and alumni activities, and blamed social engineering. According to TechCrunch, the hackers emailed alumni from official university addresses to announce the hack. BleepingComputer adds that Princeton University also disclosed a breach involving donor information that month.

Harvard has had other incidents. BleepingComputer notes that in October 2025 Harvard said it was investigating a separate matter, in which the Clop ransomware gang claimed to have exploited an Oracle E-Business Suite zero-day. That is a different intrusion with a different method, and it should not be confused with the alumni breach.

On how ShinyHunters got in, the only claim we have is the group's own. It told TechCrunch the breaches were part of recently disclosed phishing campaigns aimed at Okta and single sign-on providers. Harvard's notice describes a phone-based phishing attack and does not mention Okta. We cannot verify the group's account, and we do not repeat it as fact.

How it works

Voice phishing, or vishing, is a phone call in which the attacker impersonates IT support or a colleague and walks the target through signing in to a fake page or approving a login prompt. Because the target hands over a live session or a one-time code, strong passwords alone do not stop it. Security teams have long advised that help desks verify callers through a separate channel, and that staff treat any inbound request to sign in or approve a prompt as untrusted.

For the people in the leak, the risk comes from the breadth of the profile. HIBP's entry lists the following kinds of data:

• Names, salutations, genders, dates of birth and places of birth
• Email addresses, phone numbers and physical addresses
• Employers, job titles, occupations, education levels and social media profiles
• Family members' names and marital statuses
• Charitable donations
• Ethnicities and citizenship statuses

Not every record has every field. HIBP describes the profiles as extensive for donors, alumni and parents, and says some faculty, staff and students were also affected. The combination of a real name, a giving history and relatives' names makes it easy to write a message that looks like it comes from a development office or a relative.

What it means

For affected individuals, the immediate danger is fraud rather than account takeover. Donation-themed scams, fake reunion invoices and urgent "family emergency" calls are the likely forms. Because the data has been public since February, the criminals who want it have had it for nine months already; the HIBP listing mainly lets you find out.

For universities and charities, fundraising databases hold exactly the personal detail attackers want, and they are often reachable through the same single sign-on as the rest of the institution. The three universities named in this story were all hit through human-targeted attacks in the same month, which suggests defences need to focus on how staff are verified, not only on technical controls.

For the rest of us, the lesson is about timing. A breach disclosed in November 2025 became searchable in a public database in November 2026. Checking HIBP periodically, and using unique passwords and multi-factor authentication, covers most of the practical risk from stories like this.

What we don't know yet

• How many people were actually affected. Harvard has not said, and the 850,500 and 1 million figures count different things.
• How the attackers moved from a phone call to the alumni systems. Harvard's notice says phone-based phishing; the group's Okta claim is unverified.
• Whether Harvard has notified individuals directly. We found no statement saying how or whether it did.
• Whether the data has been resold or reused in fraud campaigns since February.
• The full contents of the archive. HIBP lists data classes, not which are present for any one person.

What to watch next

Watch for a Harvard statement with a number of affected people, for any regulator notification, and for follow-on phishing that quotes donation details. Harvard's technology office keeps a page on the incident, and the HIBP entry will show if more data is added.

Our related coverage: how to rotate leaked credentials after a platform breach and the WorkOS data breach notice.

Sources

• Have I Been Pwned: Harvard University breach entry (primary, added 3 November 2026)
• Harvard University Information Technology: recent cybersecurity incident information (Harvard's notice, cited through the reports below)
• BleepingComputer: Harvard University data breach exposed info of 851,000 accounts
• TechCrunch: Hackers publish personal information stolen during Harvard, UPenn data breaches