Harvard data breach exposes information of 851,000 accounts
A data breach at Harvard University exposed information of 851,000 accounts, BleepingComputer reports. The item does not detail the type of data involved or the cause. Account holders should watch for official communications.
What happened
Harvard University suffered a data breach exposing information linked to about 851,000 unique email addresses. The intrusion began with a phone-based phishing attack in November 2025 and hit the Alumni Affairs and Development systems. ShinyHunters claimed responsibility and published the stolen data; Harvard has not attributed the attack to the group.
Why it matters
Exposed data includes names and contact details, home and business addresses, dates of birth, employment details, donation and event-attendance records, and family information. Harvard said the affected systems generally did not contain passwords, Social Security numbers, payment cards or financial account numbers. Even so, the published data enables targeted scams, including by phone.
What to do
Anyone affiliated with Harvard should follow official university notices, change reused passwords, and treat calls and messages citing their personal details as suspicious.
For the technical team
- Affected
- Harvard University Universidade Harvard; dados de cerca de 851 mil contas expostos em vazamento · Harvard University's Alumni Affairs and Development systems; data linked to about 851,000 unique email addresses.
- Exploitation
- ShinyHunters claimed responsibility and published the stolen data, reported by DarkWebInformer; Harvard has not publicly attributed the attack to the group. BleepingComputer reported the exposure of 851,000 accounts.
- Fix
- Not applicable: data breach incident.
- Vector
- A phone-based phishing attack against Harvard University in November 2025 gave access to the Alumni Affairs and Development systems, according to DarkWebInformer.
- More details
- Exposed data: names and contact details, home and business addresses, dates of birth, employment details, donation and event-attendance records, and family and biographical information. Harvard said the affected systems generally did not contain passwords, Social Security numbers, payment card details or financial account numbers.
Timeline
New details on the vector: the intrusion came from a phone-based phishing attack in November 2025 and hit the Alumni Affairs and Development systems, exposing names, home and business addresses, dates of birth, employment details, and donation and event-attendance records.
Incident opened.
Sources 2 sources
- @BleepinComputer @BleepinComputer
- @DarkWebInformer @DarkWebInformer
