Harvard confirms data breach affecting 851,000 accounts after ShinyHunters attack

Full text

Harvard breach data affecting 850,500 people has now surfaced in breach-tracking databases and dark web archives

Exposed information includes emails, contact details, demographics, and extensive alumni and donor profile data

Attack highlights ongoing risks from social-engineering attacks against universities and fundraising systems

Hundreds of thousands of email addresses have been leaked to the dark web after the November 2025 ShinyHunters breach at Harvard University .

The same breach also exposed “extensive profile information” about certain people, as well, according to Have I Been Pwned? (HIBP), a website that aggregates stolen passwords and helps users learn which services exposed their private information.

Harvard gets hit

In late November 2025, the prestigious Ivy League University confirmed its Alumni Affairs and Development systems had been compromised after a successful voice phishing (vishing) attack.

These systems contained information about alumni, donors, some faculty and staff, and some current students, as well as data on their spouses, partners, and parents. Current and former students were also affected, it was said.

Harvard soon confirmed that the compromised data included email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and "biographical information pertaining to University fundraising and alumni engagement activities." Social Security numbers, passwords, payment card information, or financial info, was not exposed, it was said.

At the time, Harvard did not name the attackers, but the infamous ShinyHunters extortionist group claimed responsibility soon after. In a new entry on a dark web forum, the threat actors said they stole more than a million records containing personally identifiable information (PII), as well as donation data. Since the negotiations with the university broke down, the group leaked more than 1.1GB of documents in early February this year.

At the time, no one knew exactly how many people were affected. Now, after extensively analyzing the leaked archive, HIBP claims data of 850,500 accounts was compromised, including people’s names, email addresses, dates of birth, phone numbers, postal addresses, and social media profiles.

"The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students," it said.

Attacking universities

When Harvard “fell” to ShinyHunters, they were the third university to experience a breach in mere weeks, following similar incidents at both Princeton University and the University of Pennsylvania.

In early November 2025, when ShinyHunters claimed responsibility for the attack on Penn, they said they stole data on roughly 1.2 million students, alumni, and donors.

At the time, an unnamed threat actor told the media they gained “full access” to a university employee’s PennKey SSO account, which gave them access to Penn’s VPN, Salesforce data, Qlik analytics platform, SAP business intelligence system, and SharePoint files.

The crooks slammed Penn for being a “dog**** elitist institution full of woke ret*rds, who have “terrible security practices and are completely unmeritocratic.”

"We hire and admit morons because we love legacies, donors, and unqualified affirmative action admits. We love breaking federal laws like FERPA (all your data will be leaked) and Supreme Court rulings like SFFA,” ShinyHunters said in an email that was sent from a Penn account.

At first, the University of Pennsylvania described the emails as “obviously fake” and “fraudulent”, but later backtracked and confirmed the incident.

“Penn’s staff rapidly locked down the systems and prevented further unauthorized access; however, not before an offensive and fraudulent email was sent to our community and information was taken by the attacker,” it said in an update. “Penn is still investigating the nature of the information that was obtained during this time.”

Penn also said that the attack was done through social engineering. Most employees are required to use multi-factor authentication (MFA) but according to reports, some of the top brass was allowed to skip this step.

Via BleepingComputer