Have I Been Pwned has quantified the Harvard University data breach at 851,000 email addresses, BleepingComputer reported on November 3. Read that sentence carefully: this is not a new hack. The breach was discovered in November 2025. What is new is the independent measurement of the scale, nearly a year later, and the reason alumni inboxes should be on guard now.
The short version: attackers reached Harvard’s Alumni Affairs and Development systems through a phone-based phishing attack, and the leaked dataset now counts 850,537 unique email addresses. The systems did not store Social Security numbers, passwords, payment card information or financial information, according to Harvard’s chief information officer. That negative matters because it draws the line between this breach and university breaches that did expose those categories.
What happened, and when
Harvard discovered on November 18, 2025 that attackers had accessed information systems used by its Alumni Affairs and Development department, BleepingComputer reported, quoting Harvard’s disclosure. Harvard’s November 2025 disclosure attributed the intrusion to a phone-based phishing attack, and said the university removed the attacker’s access immediately and worked with law enforcement and external specialists, according to Undercode News.
The extortion gang ShinyHunters claimed responsibility and said it stole over 1 million records, and claimed to have leaked a 1.1GB archive in early February 2026 after Harvard refused to pay a ransom, BleepingComputer reported. Both claims are attributed to the gang, not confirmed by Harvard, which has not attributed the attack to any specific group. Our own timeline reconstruction: discovered in November 2025, leaked in early February 2026 about two and a half months later, and independently quantified on November 3, 2026, roughly eleven and a half months after discovery and nine months after the leak. The story is the slow quantification of a year-old breach, not a new attack.
What was exposed, and what was not
The affected systems held personal information of students, alumni, donors, staff and faculty, including email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and biographical information tied to fundraising and alumni engagement, according to BleepingComputer. Have I Been Pwned’s dataset description also lists names, dates of birth, physical addresses and social media profiles, among other profile details, and describes the data as extensive profile information for donors, alumni, parents and some faculty, staff and students.
Two qualifications keep the headline honest. First, 851,000 is a count of unique email addresses in the leaked dataset, not proof that every one of those people had every listed data category exposed; individual record contents vary. Second, approximately 64% of the exposed addresses were already present in Have I Been Pwned’s database from previous breaches, according to Have I Been Pwned via Undercode News. Our own calculation from those two figures puts about 306,193 addresses, or 36% of the total, appearing in Have I Been Pwned for the first time through this breach. For most addresses in the dataset, the address had already appeared in Have I Been Pwned from an earlier breach; for roughly three hundred thousand, this is a first appearance in Have I Been Pwned.
Why alumni inboxes are the target now
The dataset is larger than Harvard itself, and that is the point attackers will use. BleepingComputer puts Harvard’s community at over 20,000 faculty and staff, over 24,500 students, and more than 400,000 alumni worldwide. Have I Been Pwned separately describes the dataset as covering donors, alumni, parents and some faculty, staff and students, which is why the exposure reaches beyond current students and staff. Combine names, donation history and event attendance, and a phishing email impersonating a Harvard fundraising appeal can look convincingly personal.
Harvard is not alone in this pattern. Princeton University also disclosed a breach in November 2025 involving its Advancement database and donor and alumni information, while the University of Pennsylvania confirmed that development and alumni systems were compromised and information was taken, without saying precisely what data was stolen. Those are separate incidents, not the same breach, but the pattern is worth watching: whether Harvard updates its own disclosure with a confirmed individual count, which it previously declined to share with BleepingComputer, and whether the Princeton and Penn breaches receive similar independent quantification.
What to do if you think you are in the dataset
Check whether your address appears in Have I Been Pwned’s Harvard entry. If it does, the practical risk is phishing, not account takeover from this breach alone, because passwords were not in the affected systems. Treat any fundraising email that quotes your donation history or event attendance with suspicion, and verify appeals through Harvard’s official channels rather than clicking its links.
This breach does not by itself force a password change, since passwords were not exposed here. The urgent action is inbox vigilance, not a reset scramble. One related Harvard incident must not be confused with this one: a separate incident Harvard was investigating after the Clop gang claimed it had breached its systems using an Oracle E-Business Suite flaw, with files accessed in August 2025, did list Social Security numbers and carried Experian credit monitoring. That is a different breach with different data, and its details do not belong to this story.
Photo: Rizka, CC BY-SA 4.0, via Wikimedia Commons.
