Harvard University data breach exposed 851,000 accounts, ShinyHunters claims responsibility

Harvard Data Breach Details Emerge

Harvard University's Alumni Affairs and Development systems were breached in November 2025, leading to the exposure of data associated with 851,000 unique email addresses. The breach was confirmed by breach notification service Have I Been Pwned after analyzing data leaked by the cybercrime group.

The compromised information includes email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and biographical information related to university fundraising and alumni engagement activities. However, Harvard's Vice President and CIO, Klara Jelinkova, stated that the breached systems did not store Social Security numbers, passwords, payment card information, or financial information.

ShinyHunters Claims Responsibility

The ShinyHunters extortion gang claimed responsibility for the attack, stating they stole over 1 million records containing identifiable information and donation data. After Harvard refused to pay a ransom, the cybercriminals leaked a 1.1GB archive of documents on their dark web leak site in early February.

Broader Context of University Breaches

This incident follows other data breaches at Ivy League schools in November 2025, with Princeton University and the University of Pennsylvania also disclosing attacks that accessed donor information. Additionally, Harvard was investigating a separate data breach claim by the Clop ransomware gang in October 2025.