Harvard University

Summary

Harvard University disclosed that attackers breached its Alumni Affairs and Development systems and stole data linked to more than 850,000 unique email addresses. The exposed information included names, email addresses, dates of birth, phone numbers, physical addresses, social media profiles, event attendance records, donation details, and biographical information pertaining to fundraising and alumni engagement. The university stated that the breached systems did not store Social Security numbers, passwords, payment card information, or financial information. An extortion gang claimed responsibility and leaked a 1.1GB archive of documents on a dark web leak site after the institution refused to pay a ransom. Have I Been Pwned confirmed the breach affected 850,500 accounts involving donors, alumni, parents, and some faculty, staff, and students.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Harvard University discovered on November 18, 2025, that attackers had gained access to its Alumni Affairs and Development systems. The breach exposed personal information belonging to students, alumni, donors, staff, and faculty members. Compromised data included email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and biographical information pertaining to University fundraising and alumni engagement activities. Harvard's Vice President and University Chief Information Officer Klara Jelinkova stated that the breached IT systems did not store Social Security numbers, passwords, payment card information, or financial information. The university has not attributed the attack to a specific hacking group or threat actor. Have I Been Pwned later analyzed data leaked by the cybercrime gang and confirmed that the breach exposed information for 850,500 accounts. The exposed data included names, email addresses, dates of birth, phone numbers, physical addresses, social media profiles, and additional profile information. The dataset contained 851,000 unique email addresses relating to the university's alumni and fundraising systems, covering donors, alumni, parents, and some faculty, staff, and students.

The ShinyHunters extortion gang claimed responsibility for the intrusion and stated that it stole over one million records containing identifiable information and donation data. After Harvard refused to pay a ransom to have the stolen data returned and destroyed, the cybercriminals leaked a 1.1-gigabyte archive of documents on their dark web leak site in early February. A Harvard spokesperson could not share how many individuals had their information exposed when BleepingComputer requested additional details at the time. The incident occurred alongside disclosures from two other Ivy League schools, Princeton University and the University of Pennsylvania, which both reported data breaches in November 2025 involving access to donors' information.

In October 2025, Harvard informed BleepingComputer that it was investigating a second data breach after the Clop ransomware gang claimed to have breached the university's systems using an Oracle E-Business Suite zero-day vulnerability. Two months later, the University of Phoenix joined the list of U.S. universities breached by Clop using the same Oracle E-Business Suite flaw, revealing that the ransomware gang stole data from nearly 3.5 million students, staff, and suppliers in August 2025. Harvard is a private Ivy League research university with over 20,000 faculty and staff, more than 24,500 undergraduate and graduate students, and more than 400,000 alumni worldwide.

Sources

Sources available to members: 1 source.