Nearly a Year Later, Harvard’s Alumni and Donor Breach Finally Has a Number: 851,000 Email Addresses

When Harvard University disclosed a break-in at its Alumni Affairs and Development systems last November, it did not say how many people were involved. This week an outside party filled in the gap. The breach notification service Have I Been Pwned (HIBP) analyzed the files the attackers leaked and counted roughly 851,000 unique email addresses.

We based this Q&A on reporting by BleepingComputer, which covered the original incident and the new HIBP figures.

What exactly was broken into?

The systems Harvard uses for alumni relations and fundraising. The university discovered the intrusion on November 18, 2025. The people affected include alumni, donors, parents, students, faculty and staff.

What information was in those systems?

According to Harvard, contact details such as email addresses, phone numbers and home and business addresses, along with event attendance, donation details and biographical notes collected for fundraising and alumni outreach. HIBP’s review of the leaked data adds names, dates of birth and social media profiles to that list.

What was not exposed?

Harvard’s chief information officer said the affected systems did not hold Social Security numbers, passwords, payment card data or other financial information.

Who is behind it?

Harvard has not named anyone. The ShinyHunters extortion group claimed responsibility, said it took more than a million records and, after the university declined to pay, posted a 1.1GB archive on its leak site in early February. HIBP worked from that leaked material to reach its count.

Is this connected to other university breaches?

Princeton and the University of Pennsylvania both disclosed breaches involving donor information in November 2025. Separately, Harvard said in October 2025 that it was investigating claims by the Clop ransomware gang, which has been exploiting an Oracle E-Business Suite zero-day against a range of organizations, including the University of Phoenix.

If I am on that list, what should I watch for?

With no passwords or card numbers involved, the main risk is targeted fraud. A message that knows your graduation year, past donations and home address can make a fake “alumni office” appeal or a fake wire request look very convincing. Verify any request for money or personal details by contacting the organization through a number or website you already know.

What this means for your company

Most businesses keep a database that looks a lot like Harvard’s: customer profiles, donor or member records, purchase history, notes from the sales team. It rarely holds passwords or card numbers, so it rarely gets the same protection, yet it is exactly what a scammer needs to impersonate you. Know where those records live, limit who can export them, require multifactor sign-in on the systems that hold them, and keep only the details you actually use. Plan, too, for how you would tell your customers and what you would say if the data surfaced on a leak site.

Want to know how well your customer and contact databases are protected, and how you would respond if they leaked? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.