Harvard Alumni Breach Exposes 850,000 Personal Records

Harvard University’s Alumni Affairs and Development systems were breached in November 2025, exposing information for more than 850,000 individuals including students, alumni, donors, staff, and faculty. The compromised data encompassed email addresses, telephone numbers, home and business addresses, dates of birth, social media profiles, donation records, and biographical information. The university confirmed that sensitive data such as Social Security numbers, passwords, payment card information, and financial records were not included in the breach.

The ShinyHunters extortion gang claimed responsibility, and after Harvard refused to pay, the group released the stolen data in early February on a dark web site. The attack occurs amid a pattern of breaches affecting universities—Princeton University and the University of Pennsylvania also disclosed breaches in November 2025 compromising donor data. Harvard separately disclosed it was investigating a second incident involving the Clop ransomware gang, which exploited an Oracle E-Business Suite zero-day vulnerability to access university systems.